Executive brief
Gopeed is a download manager that automatically extracts downloaded archive files. A path traversal vulnerability in the archive extraction feature allows attackers to craft malicious archives that write arbitrary files outside the intended extraction directory when AutoExtract is enabled, potentially compromising system integrity or enabling remote code execution through file placement.
Technical details
The vulnerability exists in Gopeed's archive extraction code (pkg/download/extract.go) where directory traversal sequences in archive entry paths are not properly validated before file writes. An attacker can craft a malicious archive containing entries with path traversal payloads (e.g., "../../../") that bypass extraction directory restrictions when users download and auto-extract the archive, resulting in arbitrary file write capabilities on the system.
Affected products
- GopeedLab Gopeed through 2.0.0-beta.3
Timeline
- 2026-09-19: disclosed