CVE Alert: CVE-2026-93992 – GopeedLab

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.

High risk requiring prompt remediation; active exploitation cannot be confirmed because KEV, SSVC and EPSS status are not provided.

A malicious archive can overwrite files beyond the intended download location, potentially corrupting data, planting persistence or altering scripts and configuration. The practical impact depends on the permissions of the downloading process, but a successful attack could disrupt workstations or provide a stepping stone to code execution.

### Most likely attack path

An attacker hosts or distributes a crafted archive, then relies on a user to download it and trigger extraction with AutoExtract enabled. Network access is required, but complexity and privileges are low: no account is needed, while active user interaction is. Scope is unchanged, so direct cross-security-boundary impact is limited; however, files written with the client’s privileges may enable local persistence or subsequent escalation.

### Who is most exposed

Managed endpoints and shared systems used for automated or frequent downloads are most at risk, particularly where automatic extraction is enabled and the client runs with write access to application, startup or service directories.

Alert on extraction entries containing `../`, absolute paths, drive-letter paths or unusual separator combinations.

Monitor writes from the download process outside its configured download directory.

Review newly created or modified startup files, scripts, service definitions and configuration files after archive extraction.

Correlate archive downloads with unexpected process launches or persistence changes.

### Mitigation and prioritisation

Upgrade to the vendor’s fixed release as soon as change control permits; do not rely on version masking or local validation alone.

Disable AutoExtract and manually inspect archives until remediation is complete.

Restrict the client’s filesystem permissions and run it under a dedicated, unprivileged account.

Apply archive scanning and sandboxing, and limit exposure of any remotely reachable download interface.

EPSS and exploitation-state data are needed to refine urgency; absent those signals, prioritise internet-facing and privileged deployments first.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.