Skip to content

CVE-2026-88922

Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

6.7 MediumFix available

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.11%Unchanged since Sep 16, 2026

What each source reports

CVE List Score used 6.7

Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Record: CVE-2026-88922
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-281
Updated: 2026-11-02

EUVDEUVD-2026-79245 6.7

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Record: EUVD-2026-79245
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-34p9-pr49-jvvc 6.7

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation...

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Record: GHSA-34p9-pr49-jvvc
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-281
Updated: 2026-11-02

NVD 6.7

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Record: CVE-2026-88922
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-281
Updated: 2026-11-02

OSV 6.7

Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Record: CVE-2026-88922
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-281
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-88922 6.7

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Record: DEBIAN-CVE-2026-88922
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-05

Show 8 moreShow less

OSVRHSA-2026:68251 6.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:68251
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:68255 6.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:68255
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:68259 6.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:68259
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:68261 6.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:68261
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:68281 6.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:68281
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-88922 6.7

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Record: UBUNTU-CVE-2026-88922
CVSS 3.1: 6.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-103254 No score

CVE-2026-88922 affecting package packer 1.9.5-23

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Record: AZL-103254
Updated: 2026-11-05

OSVSUSE-SU-2026:4444-1 No score

Security update for terraform-provider-susepubliccloud

This update for terraform-provider-susepubliccloud fixes the following issues:

CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279252).
CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279072).
CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278763).
CVE-2026-88922: github.com/hashicorp/go-getter: improper metadata handling in archive decompression allows for creation of files with elevated permission bits and possible LPE (bsc#1280841).

Record: SUSE-SU-2026:4444-1
Updated: 2026-11-02

Affected products

hashicorp shared library

Affected packages

Affected packages
Package	Affected	Fixed
`packer` Azure Linux:3	through 1.9.5-23	None known
`golang-github-hashicorp-go-getter` Debian:12	All versions, plus listed versions 1.4.1-11.8.9-1	None known
`golang-github-hashicorp-go-getter` Debian:14	before 1.8.9-1, plus listed versions 0.0~git20160316.0.575ec4e-11.4.0-11.4.1-1	1.8.9-1
`syft` Red Hat:hummingbird:1	before 0:1.51.1-0.2.hum1	0:1.51.1-0.2.hum1
`grype` Red Hat:hummingbird:1	before 0:0.118.0-0.2.hum1	0:0.118.0-0.2.hum1
`opentofu1.10` Red Hat:hummingbird:1	before 0:1.10.10-0.4.hum1	0:1.10.10-0.4.hum1
`opentofu1.12` Red Hat:hummingbird:1	before 0:1.12.6-0.2.hum1	0:1.12.6-0.2.hum1
`trivy` Red Hat:hummingbird:1 From an advisory covering 2 CVEs	before 0:0.74.0-0.3.hum1	0:0.74.0-0.3.hum1
`terraform-provider-susepubliccloud` SUSE:Linux Enterprise Module for Public Cloud 15 SP4 From an advisory covering 4 CVEs	before 0.0.1-150100.3.26.1	0.0.1-150100.3.26.1
`terraform-provider-susepubliccloud` SUSE:Linux Enterprise Module for Public Cloud 15 SP5 From an advisory covering 4 CVEs	before 0.0.1-150100.3.26.1	0.0.1-150100.3.26.1

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`golang-github-hashicorp-go-getter` Ubuntu:18.04:LTS	All versions, plus listed versions 0.0~git20160316.0.575ec4e-1	None known
`golang-github-hashicorp-go-getter` Ubuntu:20.04:LTS	All versions, plus listed versions 0.0~git20160316.0.575ec4e-11.4.0-11.4.1-1	None known
`golang-github-hashicorp-go-getter` Ubuntu:22.04:LTS	All versions, plus listed versions 1.4.1-1	None known
`golang-github-hashicorp-go-getter` Ubuntu:24.04:LTS	All versions, plus listed versions 1.4.1-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 5, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-88922 is a medium vulnerability (CVSS 6.7) in Hashicorp Shared Library, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in golang-github-hashicorp-go-getter 1.8.9-1.

References

Show 36 moreShow less