CVE-2026-93992: Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal
Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gopeedto a version that resolves this vulnerability.Fixed in 2.0.0-beta.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Gopeed through 2.0.0-beta.3 are exposed when they download and extract a malicious archive with AutoExtract enabled.
What must an attacker do to exploit it?
The attacker must provide a crafted archive containing entries with directory traversal sequences. Exploitation also requires the target user to download the archive and have it extracted through Gopeed's AutoExtract feature.
Is user interaction required?
Yes. The target user must download the malicious archive and trigger extraction through AutoExtract.
What is the impact of successful exploitation?
A successful exploit can write files outside Gopeed's intended extraction directory. The reported impact includes integrity and availability effects.