Vulnerability · Published Oct 8, 2026 · Assigned by HashiCorp
CVE-2026-19585Go-getter vulnerable to a path traversal in S3/GCS directory download handling
Medium 5.3
In plain English
A medium-severity path traversal in Shared library from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-hashicorp-go-getter | no fix listed | DEBIAN-CVE-2026-19585 |
| Debian:14 | golang-github-hashicorp-go-getter | 1.8.9-1 | DEBIAN-CVE-2026-19585 |
| Ubuntu:22.04:LTS | golang-github-hashicorp-go-getter | no fix listed | UBUNTU-CVE-2026-19585 |
| Ubuntu:24.04:LTS | golang-github-hashicorp-go-getter | no fix listed | UBUNTU-CVE-2026-19585 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Shared library | 1.0.1 – before 2.2.5 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N