HashiCorp go-getter CVE-2026-19585

Exploitation requires the victim to use go-getter (directly or via an embedding tool such as Terraform, Packer, or Nomad) to perform a directory download specifically from an S3 or GCS source, and the attacker must control or tamper with that bucket's contents to insert object keys containing path-traversal sequences. The flaw is confined to the S3 and GCS directory-download handling paths - other getter protocols are not implicated. Limiting factors: the victim must actively initiate the download toward the malicious source (UI:R), the attack has high complexity (AC:H) because the attacker must influence remote bucket contents, and only versions below go-getter 1.8.10 / go-getter/v2 2.2.5 are affected, so patched consumers are not exploitable.

This is a medium-severity integrity flaw (CVSS 5.3) whose real-world priority is moderate rather than urgent. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N shows two significant mitigating factors: high attack complexity (AC:H) and required user interaction (UI:R), meaning the victim must actively initiate a go-getter download pointing at an attacker-influenced S3 or GCS source. The only impact is to integrity (I:H) via arbitrary file write outside the intended destination; there is no confidentiality or availability impact and no scope change (S:U). No EPSS score was provided in the input, and there is no CISA KEV listing and no public proof-of-concept referenced, so there is no evidence of active or imminent exploitation. The vendor (HashiCorp) both reported and patched the issue, which is a strong confirmation signal for the defect itself but says nothing about exploitation prevalence. Net: a real, legitimately-patchable supply-chain-style weakness that matters because go-getter underpins widely-used infrastructure tooling, but the AC:H/UI:R preconditions and integrity-only impact keep it below the threshold of an emergency. Note the conflict to verify: raw arbitrary file write could escalate to code execution in some deployments (e.g., overwriting scripts or config consumed later), which the CVSS integrity-only scoring does not capture.

An attacker who controls or can tamper with an S3 or GCS bucket that a victim fetches from crafts object keys containing path-traversal sequences. When the victim runs a go-getter-based download (e.g., via Terraform, Packer, or Nomad module/artifact retrieval) of that directory, files are written outside the requested destination, potentially overwriting sensitive files on the host. No public exploit code was identified at time of analysis, and success depends on the high-complexity preconditions in the CVSS vector (AC:H, UI:R).