GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by GopeedLab

    CVE-2026-93992 (GCVE-0-2026-93992)

    Vulnerability from nvd – Published: 2026-09-19 22:58 – Updated: 2026-09-19 22:58
    VLAI
    Title
    Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal
    Summary
    Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.
    Severity
    7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    Impacted products
    Vendor Product Version
    GopeedLab gopeed Affected: 0 , ≤ 2.0.0-beta.3 (custom)
    		Create a notification for this product.
    Date Public
    2026-09-17 00:00
    Credits
    Yu Sun
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/GopeedLab/gopeed",
          "product": "gopeed",
          "repo": "https://github.com/GopeedLab/gopeed",
          "vendor": "GopeedLab",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0-beta.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Sun"
        }
      ],
      "datePublic": "2026-09-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-19T22:58:12.558Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1525",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/GopeedLab/gopeed/issues/1525"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/GopeedLab/gopeed/commit/38750d8505274e55cf11aa77f0694c71dd82f519"
        },
        {
          "name": "7z extraction sink at v1.9.3",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract_7z.go#L45-L53"
        },
        {
          "name": "extractFile directory sink at v1.9.3",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract.go#L284-L296"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/GopeedLab/gopeed"
        },
        {
          "name": "VulnCheck Advisory: Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gopeed-through-2.0.0-beta.3-arbitrary-file-write-via-path-traversal"
        }
      ],
      "title": "Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-93992",
    "datePublished": "2026-09-19T22:58:12.558Z",
    "dateReserved": "2026-09-19T12:04:52.914Z",
    "dateUpdated": "2026-09-19T22:58:12.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-93992 (GCVE-0-2026-93992)

    Vulnerability from cvelistv5 – Published: 2026-09-19 22:58 – Updated: 2026-09-19 22:58
    VLAI
    Title
    Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal
    Summary
    Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.
    Severity
    7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
    CWE
    • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Assigner
    References
    Impacted products
    Vendor Product Version
    GopeedLab gopeed Affected: 0 , ≤ 2.0.0-beta.3 (custom)
    		Create a notification for this product.
    Date Public
    2026-09-17 00:00
    Credits
    Yu Sun
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/GopeedLab/gopeed",
          "product": "gopeed",
          "repo": "https://github.com/GopeedLab/gopeed",
          "vendor": "GopeedLab",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0-beta.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yu Sun"
        }
      ],
      "datePublic": "2026-09-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-19T22:58:12.558Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1525",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/GopeedLab/gopeed/issues/1525"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/GopeedLab/gopeed/commit/38750d8505274e55cf11aa77f0694c71dd82f519"
        },
        {
          "name": "7z extraction sink at v1.9.3",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract_7z.go#L45-L53"
        },
        {
          "name": "extractFile directory sink at v1.9.3",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/GopeedLab/gopeed/blob/a5cd53f94c18ac65add684b1113fa5f0b47cc4da/pkg/download/extract.go#L284-L296"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/GopeedLab/gopeed"
        },
        {
          "name": "VulnCheck Advisory: Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/gopeed-through-2.0.0-beta.3-arbitrary-file-write-via-path-traversal"
        }
      ],
      "title": "Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-93992",
    "datePublished": "2026-09-19T22:58:12.558Z",
    "dateReserved": "2026-09-19T12:04:52.914Z",
    "dateUpdated": "2026-09-19T22:58:12.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}