Gopeed
Monthly
Arbitrary file write via path traversal in Gopeed (through 2.0.0-beta.3) allows a crafted archive to drop files anywhere on the filesystem of the machine running the downloader. An unauthenticated remote attacker can deliver the malicious archive, but exploitation only occurs when the victim has AutoExtract enabled and downloads and extracts the file, which is why the vendor vector carries UI:A and scores 7.0 (High); integrity and availability are both rated High while confidentiality is not directly impacted. No public exploit code and no CISA KEV entry were identified at time of analysis, and an upstream fix commit has been published, though a tagged patched release has not been independently confirmed.
Arbitrary file write via path traversal in Gopeed (through 2.0.0-beta.3) allows a crafted archive to drop files anywhere on the filesystem of the machine running the downloader. An unauthenticated remote attacker can deliver the malicious archive, but exploitation only occurs when the victim has AutoExtract enabled and downloads and extracts the file, which is why the vendor vector carries UI:A and scores 7.0 (High); integrity and availability are both rated High while confidentiality is not directly impacted. No public exploit code and no CISA KEV entry were identified at time of analysis, and an upstream fix commit has been published, though a tagged patched release has not been independently confirmed.