CVE-2026-4660: Go-getter may allow to arbitrary filesystem reads through git operations

Published Apr 9, 2026

Updated

HashiCorp's go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Other sources

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

— NVD

Affected Software

2 affected componentsFixes available

go/github.com/hashicorp/go-getter<1.8.6

1.8.6

IBM Concert Software<=1.0-3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/hashicorp/go-getter to a version that resolves this vulnerability.
Fixed in 1.8.6
Upgrade
Upgrade go-getter to a version that resolves this vulnerability.
Fixed in v1.8.6Patch CVE-2026-4660

Event History

Apr 9, 2026

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeakness

Data Sourced

via Red Hat·03:01 PM

DescriptionSeverityAffected Software

Advisory Published

via GitHub·03:35 PM

Data Sourced

via GitHub·03:35 PM

DescriptionSeverityWeaknessAffected Software

Oct 14, 2026

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7292374

CVE-2026-4660: Go-getter may allow to arbitrary filesystem reads through git operations

Other sources

Affected Software

Remediation

Event History

Parent advisories

Company

Resources

Contact