Description

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-19T23:17:10.517Z",
  "pubdate": "2026-09-19T23:17:10.517Z",
  "executiveSummary": "Gopeed through version 2.0.0-beta.3 is susceptible to a path traversal vulnerability located within its archive extraction functionality.\nThe flaw stems from insufficient validation of file paths contained within archive entries, allowing an attacker to escape the designated extraction directory.\nSuccessful exploitation facilitates an arbitrary file write operation on the host filesystem when a user downloads and processes a malicious archive with the AutoExtract feature enabled.\nThis vulnerability poses a significant security risk, as it permits attackers to overwrite sensitive system files, drop malicious binaries, or manipulate application configurations.\nExploitation requires the victim to trigger the AutoExtract mechanism on a specially crafted archive, potentially leading to full system compromise depending on the user's privilege level and the target file path.",
  "technicalDetails": "The vulnerability originates in the Gopeed archive handling component responsible for decompressing files during the download process. When the AutoExtract feature is enabled, the application automatically processes downloaded archives without performing adequate sanitization of internal file path references.\nThe root cause of this flaw is the failure to properly resolve and validate entry paths against the intended extraction destination directory. Archives often contain entries with directory traversal sequences, such as '../', which are intended to facilitate file organization within the archive structure. By failing to normalize these paths and verify that the final resolution points strictly within the extraction root, the application permits file write operations to arbitrary locations on the underlying filesystem.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious archive containing one or more entries with crafted filenames involving traversal sequences (e.g., '../../../../etc/cron.d/malicious'). Second, the attacker distributes this archive via a URL to a Gopeed user. Third, the victim triggers a download of the archive through Gopeed. Fourth, upon completion, the AutoExtract functionality automatically initiates the extraction process. During the extraction of the malicious entry, the application processes the traversal sequence, resolving the destination path to a sensitive location outside the intended folder. Finally, the application writes the payload contents to the target path, potentially replacing or creating files with arbitrary data.\nThis vulnerability does not require prior authentication or elevated privileges from the attacker to initiate the archive delivery; the security impact is realized entirely through the client-side processing of the malicious archive. Post-exploitation, an attacker could achieve arbitrary code execution by overwriting startup scripts, configuration files, or replacing existing executable binaries. The impact is restricted to the filesystem permissions of the user account running the Gopeed application, but remains severe due to the potential for persistence and local escalation."
}