A path traversal flaw in Go-getter’s handling of S3 and GCS directory downloads permits an attacker to write files to locations outside the intended destination. This flaw can be leveraged to drop or overwrite arbitrary files on the target machine, potentially compromising configuration files, binaries, or other sensitive data. The weakness is a classic relative path traversal, classified as CWE‑22, and could affect confidentiality, integrity, and availability of the system.

The vulnerability exists in HashiCorp’s go-getter shared library for versions prior to 1.8.10 and in go-getter/v2 for versions prior to 2.2.5. Systems that rely on these libraries for downloading S3 or GCS directories without patching are affected.

The CVSS score of 5.3 indicates a moderate severity. Although EPSS data are not available, there is no record of exploitation in the KEV catalog. The flaw requires an attacker to supply a malicious S3 or GCS download request; the resulting path traversal operates locally within the process context, so an unprivileged application could still inject arbitrary files, but elevated privileges would increase the impact. The lack of publicly known exploits suggests a lower immediate threat, but the potential to write arbitrary files warrants attention.