---
id: CVE-2026-19585
title: >-
  HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before
  2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads,
  which may allow files to be written outside the requested destination
summary: >-
  HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before
  2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads,
  which may allow files to be written outside the requested destination. This
  vulnera…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-22
vendor: HashiCorp
product: Shared library
affected:
  - shared_library >= 1.0.1 < 2.2.5
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:07:57.460'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19585'
references:
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2026-44-go-getter-vulnerable-to-a-path-traversal-in-s3-gcs-directory-download-handling/77819
    label: security@hashicorp.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-08T16:52:14.773Z'
---

## Overview

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.