{"id":"EUVD-2026-20894","enisaUuid":"f5b83c2b-7bd6-3c39-adbf-d0c9e2a60776","description":"HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.","datePublished":"Apr 9, 2026, 1:47:46 PM","dateUpdated":"Jul 15, 2026, 12:50:08 AM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311\n","aliases":"CVE-2026-4660\nGHSA-92mm-2pjq-r785\n","assigner":"HashiCorp","epss":0.58,"enisaIdProduct":[{"id":"8dd4e553-fdb6-3055-9a29-8ddcd16eeac2","product":{"name":"Tooling","vendor":{"name":"Hashicorp"}},"product_version":"0 \u003c1.8.6"}],"enisaIdVendor":[{"id":"24d4a02c-4ac2-3191-a314-e1a5ceb02c40","vendor":{"name":"Hashicorp"}}],"enisaIdVulnerability":[{"id":"9b5b3ef5-2a76-30eb-9b94-faf1b77648de","vulnerability":{"id":"GHSA-92mm-2pjq-r785","description":"HashiCorp\u0027s go-getter library may allow arbitrary file reads","datePublished":"Apr 9, 2026, 3:35:07 PM","dateUpdated":"Apr 10, 2026, 2:11:16 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-4660\nhttps://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311\nhttps://github.com/hashicorp/go-getter\n","enisa_id":"EUVD-2026-20894\n","aliases":"GHSA-92mm-2pjq-r785\nCVE-2026-4660\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f908a2c1-e5fa-34db-b167-81aa133cee8a","vulnerability":{"id":"CVE-2026-4660","description":"HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.","datePublished":"Apr 9, 2026, 1:47:46 PM","dateUpdated":"Jul 15, 2026, 12:50:08 AM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311\n","enisa_id":"EUVD-2026-20894\n","assigner":"HashiCorp","epss":0.58,"dataProcessed":"Oct 28, 2026, 7:16:33 AM","vulnerabilityProduct":[{"id":"bed1ec0a-f4d7-3b1d-9efa-434ec1b4836b","product":{"name":"Tooling","vendor":{"name":"Hashicorp"}},"product_version":"0 \u003c1.8.6"}],"vulnerabilityVendor":[{"id":"adc8d772-bf79-397e-ac0e-68e829746f55","vendor":{"name":"Hashicorp"}}]}}],"enisaIdAdvisory":[{"id":"6e259663-c7fe-3380-a91a-3fd2f87d4b16","advisory":{"id":"RHSA-2026:24478","description":"Red Hat Security Advisory: RHTAS 1.3.5 - Red Hat Trusted Artifact Signer Release","summary":"The 1.3.5 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3","datePublished":"Jun 8, 2026, 12:54:34 PM","dateUpdated":"Oct 24, 2026, 7:32:21 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:24478\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24478.json\n","aliases":"CVE-2026-4660\nCVE-2026-32280\nCVE-2026-33810\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"354f1039-43a1-3778-95b8-dedaaafe3403","product":{"name":"Red Hat Trusted Artifact Signer 1.3","vendor":{"name":"Red Hat"}}},{"id":"d43f251f-88f3-355a-a4c3-7a61dcf5f75b","product":{"name":"registry.redhat.io/rhtas/client-server-rhel9@sha256:211b02cf9459cf687e539459ac275db49a7768124da00873fc46a0c95b9c2936_amd64","vendor":{"name":"Red Hat"}}}]}}]}