CVE-2026-4660

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Apr 9, 2026
Last modified
Jul 15, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-466007.5Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.CVE-2026-466017.5The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.CVE-2026-466027.5The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large CVE-2026-466037.5VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unuCVE-2026-466047.5The TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset.CVE-2026-466054.3Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing deCVE-2026-466067.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEMU monitoring engine (glances/plugins/vmsCVE-2026-466077.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-chCVE-2026-466087.4Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configCVE-2026-466094.6Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, whCVE-2026-46617.5The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the CVE-2026-466115.3Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s, implemented in glan