Veille CVE

‹ Retour à la liste

CVE-2026-88922

6.7 Moyenne

Publiée le 15/09/2026 à 22:19 · Modifiée le 20/09/2026 à 03:16 · Analyse NVD reportée · Source : security@hashicorp.com

Description

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Traduire en français

Produits concernés

Scores CVSS

VersionScoreSourceVecteur
3.1 6.7 Moyenne security@hashicorp.com CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Faiblesses (CWE)

Références

Ailleurs