CVE-2026-93992: Gopeed Path Traversal Vulnerability

CVE-2026-93992 Overview

CVE-2026-93992 is a path traversal vulnerability [CWE-22] in Gopeed, an open-source download manager, affecting versions through 2.0.0-beta.3. The flaw resides in the archive extraction logic, where entry names are not sanitized before being joined with the destination directory. Attackers can craft malicious archives containing directory traversal sequences (for example, ../../) that bypass validation during extraction. When a user downloads and extracts such an archive with AutoExtract enabled, Gopeed writes attacker-controlled files outside the intended extraction directory.

Critical Impact
Arbitrary file write outside the extraction directory can enable code execution, configuration tampering, or persistence when files are dropped into startup, service, or shell configuration locations.

Affected Products

Gopeed (GopeedLab) download manager
All versions up to and including 2.0.0-beta.3
Deployments using the AutoExtract feature for downloaded archives

Discovery Timeline

2026-09-19 - CVE-2026-93992 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93992

Vulnerability Analysis

Gopeed's extraction routines process archive entries by joining the entry's stored name with the destination directory using filepath.Join. Before the patch, the code did not verify whether the resulting path stayed within the destination. An archive entry named ../../etc/cron.d/payload would resolve outside the extraction directory. The vulnerable logic exists in both pkg/download/extract.go and pkg/download/extract_7z.go, as well as the Windows updater at cmd/updater/updater_windows.go. Because extraction runs with the privileges of the Gopeed process, an attacker can drop files anywhere the user has write access. This turns any downloaded archive into a delivery mechanism for arbitrary file placement.

Root Cause

The root cause is missing validation of archive entry names before file system operations. The extractor trusted fileInfo.NameInArchive and passed it directly to filepath.Join(destDir, name). Neither traversal sequences (..) nor absolute paths were rejected, violating safe archive extraction practices.

Attack Vector

An attacker crafts an archive (ZIP, 7z, or other supported format) containing entries with traversal sequences or absolute paths. The attacker distributes the archive through a URL, torrent, or repository the victim downloads via Gopeed. With AutoExtract enabled, Gopeed unpacks the archive and writes files outside the target directory. Exploitation requires user interaction to trigger the download and extraction.

// Security patch in pkg/download/extract.go
// fix: sanitize archive entry paths before extraction to prevent path traversal
func extractFile(ctx context.Context, fileInfo archives.FileInfo, destDir string) error {
	cleanPath := filepath.Clean(fileInfo.NameInArchive)
	if strings.HasPrefix(cleanPath, "..") || filepath.IsAbs(cleanPath) {
		return nil
	}

	if fileInfo.IsDir() {
		return os.MkdirAll(filepath.Join(destDir, cleanPath), fileInfo.Mode())
	}

	destPath := filepath.Join(destDir, cleanPath)

	// Create parent directories
	// ...
}
// Source: https://github.com/GopeedLab/gopeed/commit/38750d8505274e55cf11aa77f0694c71dd82f519

Detection Methods for CVE-2026-93992

Indicators of Compromise

Files written outside the configured Gopeed download or extraction directory following an archive download.
Unexpected files appearing in sensitive locations such as ~/.ssh/, ~/.config/autostart/, %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\, or system service directories after Gopeed activity.
Archive files containing entries with .. sequences or absolute paths in Gopeed's download history.

Detection Strategies

Inspect downloaded archives with tools such as unzip -l or 7z l and flag entries whose names contain .. or begin with / or a drive letter.
Correlate Gopeed process file-write events with paths outside the configured extraction directory using endpoint telemetry.
Audit the Gopeed configuration for AutoExtract state and record which users have it enabled.

Monitoring Recommendations

Monitor process ancestry for the Gopeed binary spawning writes to autostart, service, or shell configuration paths.
Alert on file creation events under user home directories originating from the Gopeed process outside its designated download folder.
Track outbound network requests from Gopeed to newly observed or low-reputation archive hosts.

How to Mitigate CVE-2026-93992

Immediate Actions Required

Upgrade Gopeed to a release that includes commit 38750d8505274e55cf11aa77f0694c71dd82f519 or later.
Disable the AutoExtract feature until the patched version is deployed on all endpoints.
Review recently downloaded archives and extraction destinations for files written outside expected directories.

Patch Information

The fix is committed in the GopeedLab repository at commit 38750d8. The patch sanitizes archive entry names with filepath.Clean and rejects any entry whose cleaned path begins with .. or is absolute. Both the general extractor in pkg/download/extract.go and the Windows updater in cmd/updater/updater_windows.go are corrected. Additional context is available in the VulnCheck advisory and GopeedLab issue #1525.

Workarounds

Turn off AutoExtract in Gopeed settings and extract archives manually with a tool that enforces path validation.
Run Gopeed under a low-privilege user account confined to a dedicated download directory.
Only download archives from trusted sources and verify contents with unzip -l or 7z l before extraction.

bash

# Configuration example: inspect archive entries for traversal before extracting
unzip -l suspicious.zip | grep -E '\.\./|^/|^[A-Za-z]:\\'
7z l suspicious.7z | grep -E '\.\./|^/|^[A-Za-z]:\\'