Gopeed CVE-2026-93992

Exploitation requires the victim to (1) have Gopeed's AutoExtract feature enabled and (2) download and extract an attacker-crafted archive containing directory-traversal entries ('..' sequences or absolute paths) that bypass the missing path sanitization. Affected versions are Gopeed through 2.0.0-beta.3 (gopeedlab:gopeed). Limiting factors: the CVSS UI:A/active-interaction requirement means no exploitation occurs without user-initiated download-and-extract, and AutoExtract must be turned on; there is no fully unattended remote path. Confidentiality is not directly impacted - the primary outcome is arbitrary file write, which may be leveraged toward code execution depending on where files are written.

The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:A/VC:N/VI:H/VA:H) scores 7.0 (High) and is internally consistent with the description: a network-delivered malicious archive achieves arbitrary file write (VI:H/VA:H) with no confidentiality impact (VC:N) but only after active user interaction (UI:A). No EPSS score, CISA KEV listing, or public exploit code is present in the supplied intelligence, so this is a genuine flaw but not an urgent, widely-exploited one - the risk is gated by user action rather than being remotely automatable. The single most important limiting factor is UI:A combined with the AutoExtract feature: the victim must both download an attacker-controlled archive AND have automatic extraction enabled. The source-code diff confirms the root cause (missing filepath.Clean + '..'/absolute-path rejection across extract.go, extract_7z.go, and the Windows updater), so the technical claim is well-substantiated by vendor patch evidence. Overall this is a real, patch-worthy issue but a moderate priority for most defenders because exploitation depends on social engineering and a non-default-behavior feature rather than unattended remote compromise. Note: arbitrary file write to attacker-chosen paths can escalate toward code execution (e.g., dropping into autostart locations), which is not fully captured by the file-write-only impact framing.

An attacker hosts or distributes a specially crafted archive whose entries contain '../' traversal sequences (or absolute paths) and lures a Gopeed user with AutoExtract enabled to download it. When Gopeed automatically extracts the archive, the traversal entries escape the extraction directory and write attacker-controlled files to arbitrary locations, potentially overwriting sensitive files or planting executables in startup/config paths. No public exploit code is identified at time of analysis, though the vendor patch diff clearly reveals the vulnerable extraction logic.