EUVD-2026-60378
GHSA-3cf4-f9v4-j353
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Plugin installation is a local, user-initiated operation (AV:L, UI:R); no account privileges needed (PR:N); path traversal escapes Packer's own directory into the host OS (S:C, I:H).
Primary rating from Vendor (HashiCorp).
CVSS VectorVendor: HashiCorp
Lifecycle Timeline
3DescriptionCVE.org
Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.
AnalysisAI
Path traversal (CWE-22) in HashiCorp Packer's third-party plugin installer through version 1.15.4 permits a crafted plugin archive to write files outside the intended extraction directory, enabling code execution on the host. Users who install plugins from malicious or compromised sources trigger the vulnerability through the normal packer plugins install workflow. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user actively invokes Packer's plugin installer (`packer plugins install`) and targets a malicious or compromised plugin archive - either a supply-chain-compromised plugin repository entry or a directly adversary-controlled distribution URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.1 with vector AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N is internally consistent with the attack model: local execution (AV:L), low complexity once triggered (AC:L), no privileges needed to run plugin installation (PR:N), but mandatory user interaction to initiate the install (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to HashiCorp Packer 1.16.0, which contains the fix per the vendor security advisory at https://discuss.hashicorp.com/t/hcsec-2026-29-packer-vulnerable-to-arbitrary-file-write-via-crafted-plugin-archive-during-installation/77654. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Packer deployments running version 1.15.4 or earlier and document current plugin sources and installation practices. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today