Path Traversal in HashiCorp go-getter before 1.8.10 / v2 2.2.5
CVE-2026-19585 Published on October 8, 2026
Go-getter vulnerable to a path traversal in S3/GCS directory download handling
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-19585 has been classified to as a Directory traversal vulnerability or weakness.
Affected Versions
HashiCorp Shared library:- Version 1.0.1 and below 2.2.5 is affected.