Go-getter may allow to arbitrary filesystem reads through git operations
Title source: cnaDescription
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.
Exploits (1)
Scores
CVSS v3
7.5
EPSS
0.0001
EPSS Percentile
2.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lab Environment
Details
CWE
CWE-200
Status
published
Products (2)
hashicorp/go-getter
0 - 1.8.6Go
HashiCorp/Tooling
< 1.8.6
Published
Apr 09, 2026
Tracked Since
Apr 09, 2026