Vulnerability Description
Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/GopeedLab/gopeed
- https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4d
- https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4d
- https://github.com/GopeedLab/gopeed/commit/38750d8505274e55cf11aa77f0694c71dd82f
- https://github.com/GopeedLab/gopeed/issues/1525
- https://www.vulncheck.com/advisories/gopeed-through-2.0.0-beta.3-arbitrary-file-
FAQ
What is CVE-2026-93992?
CVE-2026-93992 is a vulnerability with a CVSS score of 8.1 (HIGH). Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious...
How severe is CVE-2026-93992?
CVE-2026-93992 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93992?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.