CVE-2018-16874

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-22

Affected software

VendorProductVersions
[UNKNOWN]golang1.10.6; 1.11.3

References

Timeline

Published
Dec 14, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-168757.5The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verificationCVE-2018-168765.3ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leCVE-2018-168777.8A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attackerCVE-2018-168785.5A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processesCVE-2018-168799.8Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messCVE-2018-16885.4IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerabCVE-2018-168807.0A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions,CVE-2018-168817.5A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcCVE-2018-168828.8A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is CVE-2018-168835.5sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parCVE-2018-168848.0A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_CVE-2018-168855.5A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and bu
CVE-2018-16874: High severity, CVSS 8.1 | Vulnix