Description
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Shared library | 1.0.1 – < 2.2.5 | 2.2.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-hashicorp-go-getter | 1.8.9-1 | — |
| Debian 12 | golang-github-hashicorp-go-getter | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
| Ubuntu 20.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
| Ubuntu 18.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.1 | trivy | 0.76.1-160100.1.1 | openSUSE-SU-2026:22233-1 |
| openSUSE Leap 16.0 | trivy | 0.76.1-160000.1.1 | openSUSE-SU-2026:22178-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | packer | 1.9.5-23 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | conftest | 0.71.1-r7 | — |
| Wolfi rolling | k9s | 0.51.0-r29 | — |
| Wolfi rolling | kubescape | 4.0.20-r2 | — |
| Wolfi rolling | opentofu-1.12 | 1.12.12-r2 | — |
| Wolfi rolling | opentofu-1.9 +1 | No fix yet | — |
| Wolfi rolling | snyk-cli | 1.1308.4-r1 | — |
| Wolfi rolling | steampipe | 2.4.9-r2 | — |
| Wolfi rolling | task | 3.54.0-r8 | — |
| Wolfi rolling | terraform | 1.5.7-r69 | — |
| Wolfi rolling | terragrunt | 1.2.1-r3 | — |
| Wolfi rolling | tflint | 0.65.0-r2 | — |
| Wolfi rolling | tfsec | 1.28.14-r59 | — |
| Wolfi rolling | wolfictl | 0.39.31-r0 | — |
| Wolfi rolling | xeol | 0.10.8-r73 | — |
| Wolfi rolling | zarf | 0.89.0-r4 | — |
Advisories 2
- openSUSE-SU-2026:22233-1 Security update for trivy SUSE / openSUSE Security Updates · Nov 10, 2026
- openSUSE-SU-2026:22178-1 Security update for trivy SUSE / openSUSE Security Updates · Nov 1, 2026