Gopeed - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/gopeed/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 20 Sep 2026 00:16:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPath Traversal Vulnerability in Gopeed Archive Extractionhttps://feed.craftedsignal.io/briefs/2026-09-gopeed-traversal/Sun, 20 Sep 2026 00:16:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-gopeed-traversal/Gopeed through version 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows an attacker to write arbitrary files outside the designated directory when the AutoExtract feature is enabled.Gopeed versions up to and including 2.0.0-beta.3 are susceptible to a path traversal vulnerability during the archive extraction process. This flaw stems from improper validation of file paths within archive entries. When a user downloads a malicious archive and leverages the software's AutoExtract functionality, an attacker can utilize directory traversal sequences (such as ../) within the archive's internal path structure to escape the intended extraction folder. This capability allows the attacker to write or overwrite arbitrary files on the victim's filesystem. Successful exploitation could lead to system compromise, such as overwriting configuration files or placing malicious executables in startup directories, resulting in unauthorized code execution or persistence. This issue specifically impacts instances where the AutoExtract feature is actively enabled by the end user.

Impact

The vulnerability allows for arbitrary file writes on the host system, which can result in full system compromise, loss of data integrity, and unauthorized remote code execution. Users in any sector utilizing Gopeed for file downloads are at risk if they enable the AutoExtract feature and process untrusted archives.

Recommendation

Prioritized actions for security teams:

  • Identify and audit all instances of Gopeed version 2.0.0-beta.3 or earlier across the environment.
  • Disable the AutoExtract feature in Gopeed settings across all managed endpoints until an official patch is applied.
  • Monitor for unauthorized file modifications in sensitive directories (e.g., startup folders, system binaries) if Gopeed is in use.
  • Upgrade all Gopeed installations to a version released after 2.0.0-beta.3 once the vendor provides a remediation.
]]>highadvisorypath-traversalvulnerabilityfile-write