CVE-2026-19589

Received Received - Intake

Packer Plugin Installer File System Modification Vulnerability

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: HashiCorp Inc.

Description

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-19589

EUVD

EUVD-2026-60378

Affected Vendors & Products

Vendor	Product	Version / Range
hashicorp	packer	to 1.15.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Packer up to version 1.15.4 has a vulnerability in its third-party plugin installer. This flaw may allow unintended changes to the file system and could lead to code execution. The issue arises when a user installs a plugin from a malicious or compromised source.

Detection Guidance

Detecting this vulnerability requires checking the installed version of Packer. Run 'packer version' to verify if your version is below 1.16.0. If it is, the system is vulnerable.

Impact Analysis

If you use Packer versions up to 1.15.4 and install plugins from untrusted sources, an attacker could modify files on your system or execute malicious code. This could compromise your system's integrity or allow unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized file modifications or code execution, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Compliance may be impacted if systems are compromised due to this flaw.

Mitigation Strategies

Upgrade Packer to version 1.16.0 or later immediately. Download the latest version from the official Packer website and replace the existing installation.

Hi! I’m here to help you understand CVE-2026-19589. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70