CVE-2026-19589 Overview
CVE-2026-19589 is a path traversal vulnerability [CWE-22] in HashiCorp Packer versions up to and including 1.15.4. The flaw resides in the third-party plugin installer, which fails to validate file paths inside plugin archives during installation. A user who installs a plugin from a malicious or compromised source can trigger unintended file system modifications outside the plugin directory. Successful exploitation can lead to arbitrary file write and, in turn, local code execution. HashiCorp fixed the issue in Packer 1.16.0.
Critical Impact
Installing a crafted plugin archive allows an attacker to write arbitrary files on the host, enabling code execution under the invoking user's privileges.
Affected Products
- HashiCorp Packer versions up to and including 1.15.4
- Environments installing third-party Packer plugins from untrusted registries or mirrors
- CI/CD pipelines that automate packer init or plugin installation
Discovery Timeline
- 2026-08-17 - CVE-2026-19589 published to NVD
- 2026-08-17 - Last updated in NVD database
Technical Details for CVE-2026-19589
Vulnerability Analysis
Packer supports third-party plugins that extend its builder, provisioner, and post-processor functionality. When Packer installs a plugin, it retrieves an archive from a configured source and extracts the archive contents to a local plugin directory. The installer in versions up to 1.15.4 does not properly sanitize file paths contained inside the archive. An attacker who controls the archive can include entries with relative path components such as ../ or absolute paths that escape the intended extraction directory. During extraction, Packer follows those paths and writes files outside the plugin directory.
Because plugin installation runs with the privileges of the invoking user, an attacker can drop or overwrite files anywhere that user can write. Overwriting shell startup files, cron entries, systemd unit files, or binaries in the user's PATH converts the arbitrary file write into code execution the next time those files are read or invoked.
Root Cause
The root cause is missing path validation during archive extraction, a classic Zip Slip pattern tracked as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The installer trusts archive-supplied file names and does not verify that resolved destination paths remain within the target plugin directory before writing.
Attack Vector
Exploitation requires user interaction: a user must install a plugin from a source the attacker controls or has compromised. Delivery paths include a malicious plugin registry entry, a typosquatted plugin name, a compromised upstream repository, or a man-in-the-middle on an unauthenticated mirror. Once the user runs packer init or packer plugins install against the crafted source, the malicious archive is fetched and extracted, writing attacker-chosen files to attacker-chosen locations on the host.
See the HashiCorp Security Advisory HCSEC-2026-29 for vendor technical details.
Detection Methods for CVE-2026-19589
Indicators of Compromise
- Files written outside the Packer plugin directory shortly after packer init or packer plugins install execution.
- Unexpected modifications to shell profile files, cron jobs, systemd units, or binaries in the invoking user's PATH.
- Plugin archives whose entries contain .. sequences or absolute paths when inspected before installation.
- Plugin downloads from registries or mirrors not on an approved allow-list.
Detection Strategies
- Audit Packer version usage across build hosts and developer workstations; flag any instance below 1.16.0.
- Monitor process execution for packer invoking file writes outside its plugin cache directory.
- Inspect plugin archives with a tool that lists archive entries and rejects those containing traversal sequences.
- Correlate packer process activity with subsequent execution of newly written user-writable files.
Monitoring Recommendations
- Log all packer init and packer plugins install invocations in CI/CD systems with source URL and plugin name.
- Alert on file creation events under user home directories, /etc, or systemd paths spawned by a packer parent process.
- Track outbound network connections from build agents to non-approved plugin registries.
How to Mitigate CVE-2026-19589
Immediate Actions Required
- Upgrade Packer to version 1.16.0 or later on all workstations, build servers, and CI/CD runners.
- Review recent plugin installations on Packer 1.15.4 and earlier for unexpected files written outside the plugin directory.
- Restrict plugin sources to a vetted internal registry or an allow-list of trusted publishers.
- Rotate credentials and secrets accessible to any user account that ran packer init against untrusted plugin sources.
Patch Information
HashiCorp released the fix in Packer 1.16.0. The updated installer validates archive entry paths and refuses to extract files whose resolved destination falls outside the intended plugin directory. Refer to HashiCorp Security Advisory HCSEC-2026-29 for the vendor advisory.
Workarounds
- Do not install Packer plugins from untrusted or unverified sources until upgrading to 1.16.0.
- Run Packer inside an ephemeral container or sandbox so that any arbitrary file write is discarded at the end of the build.
- Pin plugin versions and checksums in Packer configuration and verify archives out-of-band before use.
- Execute Packer as a low-privilege dedicated build user with no write access to sensitive paths outside its working directory.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
