CVE-2026-19585 HashiCorp CVE debrief

Who should care

Defenders responsible for maintaining and securing environments using the go-getter library, especially those using S3 and GCS directory downloads, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-19585 is a path traversal vulnerability in HashiCorp's go-getter library that may allow files to be written outside the requested destination during S3 and GCS directory downloads. Defenders should prioritize verifying and updating affected versions, restricting permissions, and monitoring for suspicious activity.

• Potential unauthorized file writes outside the requested destination
• Possible security risks due to path traversal during directory downloads
• Need for verification and updates to affected go-getter library versions
• Potential impact on data integrity and confidentiality

Technical summary

The go-getter library, used for downloading files from various sources, is vulnerable to a path traversal attack. This vulnerability, identified as CVE-2026-19585, affects versions before 1.8.10 and 2.2.5. An attacker could potentially exploit this vulnerability to write files outside the requested destination during S3 and GCS directory downloads. The vulnerability is due to insufficient input validation, allowing an attacker to manipulate file paths. Defenders should prioritize verifying and updating affected go-getter library versions, especially in environments using S3 and GCS directory downloads, and consider implementing additional security controls to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and updating affected go-getter library versions, especially in environments using S3 and GCS directory downloads.

Recommended defensive actions

• Verify and update go-getter library versions to 1.8.10 or 2.2.5
• Review and restrict S3 and GCS directory download permissions
• Monitor for suspicious activity in environments using affected go-getter library versions
• Perform vulnerability scanning to identify exposed systems
• Implement additional logging and monitoring for S3 and GCS directory downloads
• Review incident response plans to address potential security incidents
• Conduct a thorough risk assessment to identify potential attack vectors

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed versions. However, there is limited information on potential exploitation, victims, or business impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.