CVE-2026-93992 in Gopeed
Summary
by MITRE • 09/20/2026
Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/20/2026
The security flaw identified within Gopeed versions prior to 2.0.0-beta.3 represents a critical path traversal vulnerability located in the archive extraction module. This issue stems from an insufficient validation mechanism that fails to properly sanitize file paths contained within compressed archives before they are written to the local filesystem. When users enable the AutoExtract feature, which is designed for convenience by automatically decompressing downloaded files, the application processes entries without adequately verifying whether the target path resides strictly within the designated extraction directory. This lack of strict boundary enforcement allows an attacker who controls or influences the content of a downloaded archive to manipulate the file system structure through carefully crafted input data.
The technical mechanism behind this vulnerability relies on the use of standard directory traversal sequences, such as dot-dot-slash characters, embedded within the filenames inside the compressed files. During the extraction process, these sequences are interpreted by the underlying operating system's path resolution logic rather than being stripped or rejected by the application itself. Consequently, when the archive is processed, the resulting file paths resolve to locations outside the intended sandboxed directory. This behavior effectively bypasses any superficial checks that might have been in place, allowing for arbitrary file writes across the filesystem where the user executing Gopeed has write permissions.
The operational impact of this vulnerability is severe due to its potential for remote code execution and system compromise. An attacker can craft a malicious archive containing entries with paths pointing to critical configuration files, executable scripts, or other sensitive locations on the victim's machine. By leveraging AutoExtract, which operates without explicit user intervention at the moment of extraction, the attack becomes highly effective as it requires only that the victim downloads and initiates the processing of the file. Successful exploitation could lead to the overwriting of system binaries, injection of malicious code into startup scripts, or modification of application configuration files, thereby granting the attacker persistent access or control over the affected system.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation technique also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically where an attacker uses file system manipulation to place malicious scripts in locations that are automatically executed or loaded by the operating environment. Understanding these mappings is crucial for categorizing the risk within broader threat intelligence frameworks and for developing appropriate detection signatures based on anomalous path resolution patterns during archive processing operations.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Users should upgrade Gopeed to version 2.0.0-beta.3 or later, where this specific validation logic has been corrected to ensure that all extracted files are confined within the designated extraction directory regardless of the paths specified in the archive metadata. In environments where upgrading is not immediately feasible, disabling the AutoExtract feature serves as an effective compensating control by removing the automated aspect of the vulnerability trigger. Additionally, implementing strict input validation at the application level to canonicalize and verify that all resolved file paths remain within the expected base directory before any write operations are performed would address the root cause of this flaw in future development cycles.