CVE-2026-19585 — Go-getter vulnerable to a path traversal in S3/GCS directory download handling

CVE-2026-19585

Go-getter vulnerable to a path traversal in S3/GCS directory download handling PUBLISHED

Description (CNA)

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Shared library	affected 1.0.1 before 2.2.5

CWE

CWE-22

References

https://discuss.hashicorp.com/t/hcsec-2026-44-go-getter-vulnerable-to-a-path-traversal-in-s3-gcs-directory-download-handling/77819

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.