CVE-2026-19585: HashiCorp go-getter Path Traversal Flaw

CVE-2026-19585 Overview

CVE-2026-19585 is a path traversal vulnerability in HashiCorp go-getter, a library used by Terraform and other tools to fetch files and directories from remote sources. The flaw affects go-getter versions prior to 1.8.10 and go-getter/v2 versions prior to 2.2.5. When downloading directories from Amazon S3 or Google Cloud Storage (GCS), the library fails to properly validate object keys. A crafted bucket or object layout can cause files to be written outside the requested destination directory. The issue is tracked under CWE-22 and is documented in HashiCorp Security Advisory HCSEC-2026-44.

Critical Impact
An attacker who controls or influences an S3 or GCS source can write files to arbitrary filesystem paths accessible to the downloading process, enabling tampering with configuration, scripts, or binaries.

Affected Products

HashiCorp go-getter versions before 1.8.10
HashiCorp go-getter/v2 versions before 2.2.5
Downstream tools that embed vulnerable go-getter releases to fetch S3 or GCS directories

Discovery Timeline

2026-10-08 - CVE-2026-19585 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-19585

Vulnerability Analysis

The go-getter library resolves remote sources into local directory trees. For S3 and GCS directory downloads, it enumerates objects under a prefix and writes each object to a file path derived from the object key. The library does not sufficiently sanitize object keys before joining them to the destination directory. An object key containing .. segments or absolute path components causes the resolved write path to escape the intended destination.

Exploitation requires user interaction, such as a developer or automation pipeline initiating a go-getter fetch against a malicious or attacker-influenced bucket. Attack complexity is high because the attacker must stage specific object keys and induce the target to download from the controlled source. Impact is limited to integrity: files can be created or overwritten outside the destination, but the issue does not directly expose confidentiality or availability.

Root Cause

The root cause is insufficient validation of remote-supplied path components during directory expansion from S3 and GCS backends. The library trusted object keys as safe relative paths when constructing filesystem destinations.

Attack Vector

An attacker who controls an S3 or GCS bucket, or who can influence a Terraform module or build pipeline to point at one, stages objects whose keys include traversal sequences. When a victim invokes go-getter to pull the directory, the library writes files outside the target directory. Overwriting executables, hooks, CI scripts, or Terraform state files can enable follow-on code execution or supply-chain tampering.

No verified public proof-of-concept code is available. See the HashiCorp Security Advisory HCSEC-2026-44 for vendor-provided technical details.

Detection Methods for CVE-2026-19585

Indicators of Compromise

Files created or modified outside the expected go-getter destination directory following a module or artifact fetch.
S3 or GCS object keys containing ../, backslashes, or absolute path prefixes observed in bucket listings referenced by Terraform or build pipelines.
Unexpected changes to CI/CD scripts, SSH keys, or shell profiles on build hosts shortly after a terraform init or go-getter invocation.

Detection Strategies

Inventory build and runtime environments for go-getter versions below 1.8.10 and go-getter/v2 versions below 2.2.5 using software composition analysis.
Audit Terraform modules and automation that use s3:: or gcs:: source prefixes and verify the trust level of the referenced buckets.
Instrument build agents to log file writes performed by processes invoking go-getter and alert on writes outside the designated workspace.

Monitoring Recommendations

Monitor CI/CD runners for process writes to paths outside the configured working directory during artifact or module fetches.
Alert on new or modified S3/GCS objects whose keys contain path traversal patterns in buckets consumed by infrastructure automation.
Track dependency manifests (go.mod, vendored directories) for pinned go-getter versions across repositories.

How to Mitigate CVE-2026-19585

Immediate Actions Required

Upgrade go-getter to version 1.8.10 or later, and go-getter/v2 to version 2.2.5 or later, in all services and build images.
Rebuild and redeploy downstream tools and internal binaries that statically link go-getter.
Restrict go-getter S3 and GCS sources to buckets under organizational control and remove references to third-party or untrusted buckets.

Patch Information

HashiCorp fixed the issue in go-getter1.8.10 and go-getter/v22.2.5. Review HashiCorp Security Advisory HCSEC-2026-44 for the full patch notes and affected module list.

Workarounds

Avoid using go-getter to download directories from S3 or GCS sources that are not fully controlled by your organization.
Run go-getter-based tools under least-privilege accounts in isolated workspaces so that any out-of-path writes are contained.
Enforce bucket policies that reject object keys containing traversal characters before publication.

bash

# Verify and upgrade go-getter in a Go module
go list -m -versions github.com/hashicorp/go-getter
go get github.com/hashicorp/go-getter@v1.8.10

# For go-getter/v2
go get github.com/hashicorp/go-getter/v2@v2.2.5
go mod tidy