CVE-2026-4660-PoC

PoC de CVE-2026-4660 Prueba de concepto para CVE-2026-4660 aviso de HashiCorp en hashicorp/go-getter. Soy el reportero original. Un atacante publica un módulo de Terraform con un ref de --pathspec-from-file=/ruta/al/archivo. Cuando la víctima ejecuta terraform init, go-getter clona el repositorio...

CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

EUVD-2026-95078

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585

HashiCorp go-getter versions prior to 1.8.10 and go-getter/v2 versions prior to 2.2.5 are vulnerable to a path traversal vulnerability (CWE-22) during S3 and GCS directory downloads. This flaw may allow an attacker to write files outside of the intended destination directory. The vulnerability is...

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issues: CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1279252. CVE-2026-84304:...

Linux Distros Unpatched Vulnerability : CVE-2026-88922

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafte...

CVE-2026-88922

A flaw was found in the go-getter library. This vulnerability allows a local attacker to escalate privileges by providing a specially crafted archive. When a privileged user extracts this archive, files can be created with elevated permission bits, enabling the attacker to gain the privileges of...

SUSE CVE-2026-88922

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...

github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompression

A flaw was found in the go-getter library. This vulnerability allows a local attacker to escalate privileges by providing a specially crafted archive. When a privileged user extracts this archive, files can be created with elevated permission bits, enabling the attacker to gain the privileges of...

github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompression

A flaw was found in the go-getter library. This vulnerability allows a local attacker to escalate privileges by providing a specially crafted archive. When a privileged user extracts this archive, files can be created with elevated permission bits, enabling the attacker to gain the privileges of...

github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompression

A flaw was found in the go-getter library. This vulnerability allows a local attacker to escalate privileges by providing a specially crafted archive. When a privileged user extracts this archive, files can be created with elevated permission bits, enabling the attacker to gain the privileges of...

github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompression

A flaw was found in the go-getter library. This vulnerability allows a local attacker to escalate privileges by providing a specially crafted archive. When a privileged user extracts this archive, files can be created with elevated permission bits, enabling the attacker to gain the privileges of...

github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompression

A flaw was found in the go-getter library. This vulnerability allows a local attacker to escalate privileges by providing a specially crafted archive. When a privileged user extracts this archive, files can be created with elevated permission bits, enabling the attacker to gain the privileges of...

Security Bulletin: Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

Summary The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged use...

DEBIAN-CVE-2026-88922

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...

AZL-103254 CVE-2026-88922 affecting package packer 1.9.5-21

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...

CVE-2026-88922

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...

CVE-2026-88922

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...

CVE-2026-88922 Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this...