Medium severity · published Oct 8, 2026
CVE-2026-19585
Go-getter vulnerable to a path traversal in S3/GCS directory download handling
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Shared library · HashiCorp
1.0.1 before 2.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19585
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19585
discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2026-44-go-getter-vulnerable-to-a-path-traversal-in-s3-gcs-directory-download-handling/77819
More from Shared library
9.8
CVE-2024-3817
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
9.1
CVE-2025-0377
HashiCorp go-slug Vulnerable to Zip Slip Attack
8.8
CVE-2026-0969
Arbitrary code execution in React server-side rendering of untrusted MDX content
8.8
CVE-2024-6257
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation
7.5
CVE-2025-8959
HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack