CVE-2026-19589 PUBLISHED

Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Assigner: HashiCorp
Reserved: 12.08.2026 Published: 17.08.2026 Updated: 17.08.2026

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CVSS Score: 7.1

Attack Vector	Local	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	HashiCorp
Product	Packer
Versions	Default: unaffected affected from 1.7.0 to 1.16.0 (excl.)

Credits

This issue was reported to HashiCorp by George Chen.

References

https://discuss.hashicorp.com/t/hcsec-2026-29-packer-vulnerable-to-arbitrary-file-write-via-crafted-plugin-archive-during-installation/77654

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) CWE

Impacts

CAPEC-23: File Content Injection