HCSEC-2026-29 - Packer vulnerable to arbitrary file write via crafted plugin archive during installation

{
  "id": "d244d1be8c63a8b375ca14201e071e0c66cfe995b73f1698754c4ed2808bc360",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-29-packer-vulnerable-to-arbitrary-file-write-via-crafted-plugin-archive-during-installation/77654",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-29 - Packer vulnerable to arbitrary file write via crafted plugin archive during installation",
    "summary": "Packer’s plugin installer could extract crafted archives outside the intended plugin directory, potentially allowing code execution. Upgrade to Packer 1.16.0.",
    "evidence": "This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.",
    "products": [
      {
        "name": {
          "value": "Packer",
          "evidence": "Packer 1.7.0 up to 1.15.4; fixed in Packer 1.16.0"
        },
        "prerequisites": [
          {
            "value": "install third-party plugins from a malicious or compromised source using packer init or packer plugins install",
            "evidence": "This issue affects users who install third-party plugins from a malicious or compromised source using packer init or packer plugins install."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.16.0",
            "evidence": "Packer 1.7.0 up to 1.15.4; fixed in Packer 1.16.0"
          }
        ],
        "affected_versions": [
          {
            "value": "1.7.0 up to 1.15.4",
            "evidence": "Packer 1.7.0 up to 1.15.4; fixed in Packer 1.16.0"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-19589",
        "product": "Packer",
        "evidence": "This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-19589",
        "evidence": "This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24013,
  "published_at": "2026-08-17T20:20:56+00:00"
}