CVE-2026-19589 Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

CVE-2026-19589

Packer's plugin installer failed to constrain extraction paths (CWE-22), allowing a crafted archive to write files outside the plugin directory and achieve code execution. Affected versions: 1.7.0–1.15.4. Fixed in 1.16.0. Exploitation details are not provided in the documents. Users should upgrad...

EUVD-2026-60378

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...