CVE-2026-19585 — Go-getter vulnerable to a path traversal in S3/GCS directory download handling
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files t…
Published: 2026-10-08 · CVSS: 5.3 · CVSS 3.1
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7