CVE-2026-93992
Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal
- State
- Published
- Severity
- 7.0 High
- Published
- Sep 19, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 19, 2026
Description
Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
gopeedGopeedLab |
|
References
- GitHub Issue #1525issue-tracking
- https://github.com/GopeedLab/gopeed/commit/38750d8505274e55cf11aa77f0694c71dd82f519patch
- 7z extraction sink at v1.9.3technical-description
- extractFile directory sink at v1.9.3technical-description
- https://github.com/GopeedLab/gopeedproduct
- VulnCheck Advisory: Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversalthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.