A path traversal vulnerability in Gopeed archive extraction allows remote attackers to perform arbitrary file write operations, potentially leading to unauthorized system changes.

This is a path traversal vulnerability (CWE-22) residing in the archive extraction functionality. The application fails to properly validate entries within malicious archives, allowing an unauthenticated attacker to escape the target directory and write files to arbitrary locations on the host system when AutoExtract is enabled.

Successful exploitation of this vulnerability permits an attacker to overwrite sensitive system files or place malicious executables in startup directories, which can facilitate remote code execution or complete system compromise. Given the high CVSS score of 8.1, this flaw presents a significant risk to the integrity and availability of any host running the affected software.

Immediate Action: Update Gopeed to the latest version immediately to ensure the patch for path traversal validation is active.

Proactive Monitoring: Review application logs and system file integrity monitors for unauthorized file creation attempts or unexpected write operations occurring in directories outside of designated download folders.

Compensating Controls: If an immediate update is not possible, disable the AutoExtract feature to prevent the automatic processing of potentially malicious archives.

Public Exploit Available: Unknown.

The risk posed by this path traversal vulnerability is severe due to the potential for arbitrary file writes on the host system. All administrators and users of Gopeed should verify their installation version and apply the vendor-provided security update as a matter of urgency to mitigate the risk of system compromise.