CLEANSTART-2026-VV62623 HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries

Security vulnerability affects the opentofu package. HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries...

CLEANSTART-2026-HG96871 HashiCorp’s go-getter library up to v1

Security vulnerability affects the opentofu package. HashiCorp’s go-getter library up to v1...

CVE-2026-4660-PoC

CVE-2026-4660 PoC Proof of concept for CVE-2026-4660 HashiCorp advisory in hashicorp/go-getter. I'm the original reporter. An attacker publishes a Terraform module with a ref of --pathspec-from-file=/path/to/file. When the victim runs terraform init, go-getter clones the repo and calls git checko...

OPENSUSE-SU-2026:22178-1 Security update for trivy

This update for trivy fixes the following issues: - CVE-2026-19585: github.com/hashicorp/go-getter: path traversal during S3 and GCS directory downloads may allow files to be written outside the requested destination bsc1284829. - CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption...

ROOT-APP-GOBINARY-CVE-2024-6257 CVE-2024-6257 in github.com/hashicorp/go-getter - Patched by Root

Root has patched CVE-2024-6257 in the github.com/hashicorp/go-getter package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-4660 CVE-2026-4660 in github.com/hashicorp/go-getter - Patched by Root

Root has patched CVE-2026-4660 in the github.com/hashicorp/go-getter package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2025-8959 CVE-2025-8959 in github.com/hashicorp/go-getter - Patched by Root

Root has patched CVE-2025-8959 in the github.com/hashicorp/go-getter package for Root:Go. Multiple fixed versions available...

UBUNTU-CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

Exploit for Type Confusion in Google Chrome

CVE-2025-13224 PoC - Write-up: https://jamezx32.github.i...

GO-2026-6599 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller-fips, hydra-fips, grafana-tempo-datasource-fips, knative-net-istio-fips, crossplane-provider-aws-networkfirewall-fips, memcached-exporter-fips, prometheus-pushgateway-fips, etcd, go-getter,...

SUSE CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585

A flaw was found in go-getter. A remote attacker can exploit a path traversal vulnerability to write files outside of the intended target directory during directory downloads from Amazon Simple Storage Service S3 or Google Cloud Storage GCS. By supplying specially crafted file paths within a remo...

Linux Distros Unpatched Vulnerability : CVE-2026-19585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which...

Security Bulletin: Go-getter vulnerable to a path traversal in S3/GCS directory download handling

Summary HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 a...

AZL-107799 CVE-2026-19585 affecting package packer for versions less than 1.9.5-23

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

DEBIAN-CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

EUVD-2026-95078

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...