CVE-2026-93992

Publié : 19 septembre 2026

Modifié : 19 septembre 2026

Score CVSS

8.1

HIGH

Description détaillée

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Références et Patchs

https://github.com/GopeedLab/gopeed https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract.go#L284-L296 https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract_7z.go#L45-L53 https://github.com/GopeedLab/gopeed/commit/38750d8505274e55cf11aa77f0694c71dd82f519 https://github.com/GopeedLab/gopeed/issues/1525 https://www.vulncheck.com/advisories/gopeed-through-2.0.0-beta.3-arbitrary-file-write-via-path-traversal

Dernières Vulnérabilités

CVE-2026-94057

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

VOIR DÉTAILS

CVE-2026-94056

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

VOIR DÉTAILS

CVE-2026-94055

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

VOIR DÉTAILS