Vendor
Gopeed through version 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows an attacker to write arbitrary files outside the designated directory when the AutoExtract feature is enabled.