CVE-2026-93992

Received Received - Intake

Path Traversal in Gopeed Archive Extraction

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93992

Affected Vendors & Products

Vendor	Product	Version / Range
gopeed	gopeed	2.0.0-beta.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Gopeed through 2.0.0-beta.3 has a path traversal vulnerability during archive extraction. Attackers can create malicious archives with directory traversal sequences that bypass validation, allowing them to write files outside the intended extraction directory when users use AutoExtract.

Detection Guidance

To detect this vulnerability, monitor for unexpected file writes outside intended directories during archive extraction. Check logs for Gopeed's AutoExtract feature usage and inspect extracted archives for paths containing '..' or similar traversal sequences. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to overwrite system files, install malware, or gain unauthorized access to sensitive data by tricking users into extracting a malicious archive. It may lead to system compromise or data breaches depending on the attacker's goals.

Mitigation Strategies

Disable AutoExtract in Gopeed, update to the latest patched version if available, and avoid extracting archives from untrusted sources. Implement file system restrictions to prevent writes outside designated directories.

Hi! I’m here to help you understand CVE-2026-93992. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70