{"id":"CVE-2026-88922","aliases":["AZL-103254","DEBIAN-CVE-2026-88922","EUVD-2026-79245","GHSA-34p9-pr49-jvvc","RHSA-2026:68251","RHSA-2026:68255","RHSA-2026:68259","RHSA-2026:68261","RHSA-2026:68281","SUSE-SU-2026:4444-1","UBUNTU-CVE-2026-88922"],"status":"published","title":"Go-getter vulnerable to a privilege escalation issue in its archive decompression handling","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00113,"percentile":0.01428,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-281"],"published":"2026-09-15T19:45:07Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Debian:14","package":"golang-github-hashicorp-go-getter","fixed_in":["1.8.9-1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"syft","fixed_in":["0:1.51.1-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"grype","fixed_in":["0:0.118.0-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"opentofu1.10","fixed_in":["0:1.10.10-0.4.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"opentofu1.12","fixed_in":["0:1.12.6-0.2.hum1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"packer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.5-23"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-hashicorp-go-getter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-1","1.8.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-hashicorp-go-getter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.9-1"}]}],"versions":["0.0~git20160316.0.575ec4e-1","1.4.0-1","1.4.1-1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"syft","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.51.1-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grype","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.118.0-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"opentofu1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.10-0.4.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"opentofu1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.6-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.74.0-0.3.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"terraform-provider-susepubliccloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.1-150100.3.26.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-hashicorp-go-getter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20160316.0.575ec4e-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-hashicorp-go-getter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20160316.0.575ec4e-1","1.4.0-1","1.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-hashicorp-go-getter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-hashicorp-go-getter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-1"]}],"products":[{"vendor":"hashicorp","product":"shared library"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752","tags":["web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88922","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-34p9-pr49-jvvc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88922.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/go-getter","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88922","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68251","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-88922","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68251.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534192","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88922","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68255","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68255.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68259","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68259.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68261","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68261.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68281","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71557","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68281.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512557","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71557","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71557","tags":["advisory"]},{"url":"https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7","tags":["article"]},{"url":"https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36","tags":["article"]},{"url":"https://github.com/go-git/go-git/pull/2247","tags":["article"]},{"url":"https://github.com/go-git/go-git/pull/2254","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v5.19.2","tags":["article"]},{"url":"https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","tags":["article"]},{"url":"https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264444-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1278763","tags":["report"]},{"url":"https://bugzilla.suse.com/1279072","tags":["report"]},{"url":"https://bugzilla.suse.com/1279252","tags":["report"]},{"url":"https://bugzilla.suse.com/1280841","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88922","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-88922","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-88922","title":"Go-getter vulnerable to a privilege escalation issue in its archive decompression handling","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","status":"published","published":"2026-09-15T19:45:07.836Z","modified":"2026-09-20T00:40:33.962Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-79245","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","status":"published","published":"2026-09-15T19:45:07Z","modified":"2026-09-20T00:40:33Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T17:28:06.225065Z"}],"ghsa":[{"id":"GHSA-34p9-pr49-jvvc","title":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation...","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","status":"published","published":"2026-09-15T21:33:02Z","modified":"2026-09-15T21:33:13Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T15:11:56.361668Z"}],"nvd":[{"id":"CVE-2026-88922","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","status":"published","published":"2026-09-15T20:19:19.813Z","modified":"2026-09-20T01:16:31.763Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T14:12:48.287983Z"}],"osv":[{"id":"CVE-2026-88922","title":"Go-getter vulnerable to a privilege escalation issue in its archive decompression handling","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","status":"published","published":"2026-09-15T19:45:07.836Z","modified":"2026-10-28T02:31:03.533904616Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-281"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-88922","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","status":"published","published":"2026-09-15T20:19:19.813Z","modified":"2026-11-05T04:00:16.538559165Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"RHSA-2026:68251","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:05Z","modified":"2026-09-22T10:30:38.56165255Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68255","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:06Z","modified":"2026-09-22T10:31:46.956575751Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68259","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:07Z","modified":"2026-09-22T10:31:24.768819703Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68261","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:08Z","modified":"2026-09-22T10:32:10.776013867Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68281","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:19:10Z","modified":"2026-10-16T10:23:25Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-88922","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","status":"published","published":"2026-09-15T20:19:00Z","modified":"2026-10-28T20:18:17.823799307Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"AZL-103254","title":"CVE-2026-88922 affecting package packer 1.9.5-23","description":"The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.","status":"published","published":"2026-09-15T20:19:19Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:17.326541Z"},{"id":"SUSE-SU-2026:4444-1","title":"Security update for terraform-provider-susepubliccloud","description":"This update for terraform-provider-susepubliccloud fixes the following issues:\n\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279252).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279072).\n- CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS\n  servers (bsc#1278763).\n- CVE-2026-88922: github.com/hashicorp/go-getter: improper metadata handling in archive decompression allows for\n  creation of files with elevated permission bits and possible LPE (bsc#1280841).\n","status":"published","published":"2026-10-05T08:19:27Z","modified":"2026-10-05T18:00:04.523698351Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}