CVE-2026-4660

What it actually does

Path traversal in go-getter up to 1.8.5 permits reading arbitrary files from the host filesystem when processing a maliciously crafted git URL during fetch or clone operations.

Why it matters to the business

Attackers can obtain sensitive configuration files, credentials, or source code from systems that use the library, increasing risk of further compromise or data leakage.

How an attack unfolds

An attacker crafts a git URL containing path traversal sequences, supplies it to any application or build process that invokes go-getter for repository retrieval, and receives the contents of files outside the intended working directory.

How to fix it

Upgrade go-getter to version 1.8.6 or later; the v2 branch is unaffected. Verify the version in all Go modules and rebuild dependent artifacts.

How to confirm the fix worked

Run go list -m github.com/hashicorp/go-getter and confirm the resolved version is 1.8.6 or newer; re-execute unit tests that exercise git fetch paths.

Typical attack path

1. Identify a target that uses go-getter for git operations
2. Craft a malicious git URL embedding ../ sequences
3. Trigger the library to process the URL via dependency fetch or clone
4. Receive file contents from arbitrary filesystem locations

How to detect it

Review build logs and dependency-fetch audit trails for unexpected file paths or error messages referencing traversal sequences; correlate with process execution of git commands containing unusual URL patterns.

What your security team should do

• Prioritize upgrade of go-getter to 1.8.6 across all build pipelines and tools
• Scan SBOMs and dependency manifests for any reference to versions <=1.8.5
• Add dependency pinning and automated update checks to CI workflows