HCSEC-2026-44 - Go-getter vulnerable to a path traversal in S3/GCS directory download handling

{
  "id": "df2d32ab95a54395b51028ad42074036592553a23f0dfd7bb4914e92fd329e27",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-44-go-getter-vulnerable-to-a-path-traversal-in-s3-gcs-directory-download-handling/77819",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-44 - Go-getter vulnerable to a path traversal in S3/GCS directory download handling",
    "summary": "Go-getter’s S3 and GCS directory download handling could write files outside the requested destination. The issue is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.",
    "evidence": "This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.",
    "products": [
      {
        "name": {
          "value": "go-getter",
          "evidence": "Affected Products / Versions: Go-getter up to 1.8.9 and 2.2.4; fixed in go-getter 1.8.10 and 2.2.5"
        },
        "prerequisites": [
          {
            "value": "S3 and GCS directory downloads",
            "evidence": "S3 and GCS directory downloads did not ensure that each listed object’s destination remained within the requested directory."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.8.10",
            "evidence": "Affected Products / Versions: Go-getter up to 1.8.9 and 2.2.4; fixed in go-getter 1.8.10 and 2.2.5"
          }
        ],
        "affected_versions": [
          {
            "value": "up to 1.8.9",
            "evidence": "Affected Products / Versions: Go-getter up to 1.8.9 and 2.2.4; fixed in go-getter 1.8.10 and 2.2.5"
          }
        ]
      },
      {
        "name": {
          "value": "go-getter/v2",
          "evidence": "This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5."
        },
        "prerequisites": [
          {
            "value": "S3 and GCS directory downloads",
            "evidence": "HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads"
          }
        ],
        "fixed_versions": [
          {
            "value": "2.2.5",
            "evidence": "This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5."
          }
        ],
        "affected_versions": [
          {
            "value": "before 2.2.5",
            "evidence": "HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-19585",
        "product": "go-getter",
        "evidence": "This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5."
      },
      {
        "cve": "CVE-2026-19585",
        "product": "go-getter/v2",
        "evidence": "This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-19585",
        "evidence": "This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 23998,
  "published_at": "2026-10-08T15:16:21+00:00"
}