CVE-2026-93992 Details
Description
Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.
A path traversal vulnerability has been identified in Gopeed versions through 2.0.0-beta.3, specifically in the archive extraction feature. This vulnerability allows attackers to craft malicious archives that, when downloaded and extracted by users with AutoExtract enabled, can write arbitrary files outside the designated extraction directory. The issue arises because the archive extraction process fails to properly validate directory traversal sequences, enabling the crafted files to be written to unintended locations on the filesystem.
Users can update to Gopeed version 2.0.0-beta.3 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 19, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/GopeedLab/gopeed/issues/1525 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/GopeedLab/gopeed | [email protected] | ProductVendor |
| https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract_7z.go#L45-L53 | [email protected] | Source CodeVendor |
| https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract.go#L284-L296 | [email protected] | Source CodeVendor |
| https://github.com/GopeedLab/gopeed/commit/38750d8505274e55cf11aa77f0694c71dd82f519 | [email protected] | Source CodeVendor |
| https://github.com/GopeedLab/gopeed/issues/1525 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/gopeed-through-2.0.0-beta.3-arbitrary-file-write-via-path-traversal | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GopeedLab Gopeed | <= 2.0.0-beta.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 19, 2026 | New CVE Received | [email protected] |