EUVD-2026-79245
GHSA-34p9-pr49-jvvc
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (hashicorp) · only source for this CVE.
CVSS VectorVendor: hashicorp
Lifecycle Timeline
2DescriptionCVE.org
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
AnalysisAI
Improper permission preservation during archive decompression in the HashiCorp go-getter library (1.8.x up to 1.8.8 and 2.x up to 2.2.3) lets a crafted archive cause extracted files to be created with attacker-influenced, elevated permission bits. When the extraction is performed by a privileged process — for example a root-run provisioning, CI, or orchestrator agent — a local actor can leverage the resulting files to gain the privileges of that extracting process, escalating from a low-privileged position to root or service-level access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-281 – Improper Preservation of Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today