CVE-2026-93992highCWE-22

Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7epss 0.9%

probabilidade de exploração

0.9%top 42% das CVEs

exploração observada

nãonenhuma fonte reporta

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

GopeedLab · gopeed

Referências

https://github.com/GopeedLab/gopeed https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract_7z.go#L45-L53 https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract.go#L284-L296 https://github.com/GopeedLab/gopeed/commit/38750d8505274e55cf11aa77f0694c71dd82f519 https://github.com/GopeedLab/gopeed/issues/1525 https://www.vulncheck.com/advisories/gopeed-through-2.0.0-beta.3-arbitrary-file-write-via-path-traversal