CVE-2026-19589: 
Packer vulnerability analysis and mitigation

CVE-2026-19589 is an arbitrary file write vulnerability in HashiCorp Packer's third-party plugin installer that may allow unintended file system modification and could lead to code execution. It affects Packer versions 1.7.0 through 1.15.4 and is fixed in Packer 1.16.0. The vulnerability was published on August 17, 2026, with a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, HashiCorp Advisory).

The root cause is improper path validation in Packer's plugin installation mechanism, classified as CWE-22 (Path Traversal). When a user installs a third-party plugin, Packer fails to adequately restrict file extraction paths within the plugin archive, allowing a crafted archive to write files to arbitrary locations on the file system outside the intended plugin directory. Exploitation requires local access and user interaction — specifically, a user must be socially engineered or otherwise induced to install a plugin from a malicious or compromised source. The attack vector is local with low complexity and no privileges required, but a changed scope indicates the impact extends beyond the Packer process itself (GitHub Advisory, HashiCorp Advisory).

Successful exploitation allows an attacker to write arbitrary files to the victim's file system, which can lead to code execution in the context of the user running Packer. The integrity impact is rated High, with a low confidentiality impact (e.g., overwriting sensitive files or planting malicious executables), while availability is unaffected. Because the scope is marked as Changed, the impact can extend beyond the Packer process to other components or resources on the system, potentially enabling persistence or privilege escalation depending on the files overwritten (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for user interaction. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, HashiCorp Advisory).

1. Prepare malicious plugin archive: An attacker creates a crafted Packer plugin archive (e.g., a ZIP or tar file) containing files with path traversal sequences in their names (e.g., ../../.bashrc or ../../cron.d/malicious) to target files outside the intended plugin installation directory.
2. Distribute the malicious plugin: The attacker hosts the crafted archive on a compromised plugin registry, a typosquatted domain, or a repository impersonating a legitimate Packer plugin source.
3. Social engineering: The attacker induces a target user to install the malicious plugin using the packer plugins install command or equivalent, pointing to the attacker-controlled source.
4. Trigger file write: When Packer extracts the plugin archive, it fails to sanitize the traversal sequences, causing files to be written to attacker-specified locations on the file system (e.g., overwriting shell configuration files, cron jobs, or SSH authorized keys).
5. Achieve code execution: The attacker's planted file (e.g., a modified .bashrc, a cron job, or a replaced binary) is subsequently executed by the system or user, granting the attacker arbitrary code execution (HashiCorp Advisory, GitHub Advisory).

• File System: Unexpected files created outside the Packer plugin directory (typically ~/.packer.d/plugins/ or equivalent) following a plugin installation; newly created or modified shell configuration files (.bashrc, .profile, .bash_profile), cron entries, or SSH authorized_keys files with unusual timestamps.
• Logs: System or audit logs showing file creation or modification events in sensitive directories (e.g., /etc/cron.d/, ~/.ssh/) by the Packer process around the time of plugin installation.
• Process: Unexpected processes spawned from shell or cron shortly after a Packer plugin installation event; unusual outbound network connections from the user's session following plugin installation.

HashiCorp has released Packer 1.16.0 to address this vulnerability, and upgrading is the recommended remediation (HashiCorp Advisory). As a workaround, users should only install plugins from trusted, verified, and official sources, and should review and validate plugin archive contents before installation. Organizations should audit any plugins installed from third-party sources using Packer versions 1.7.0–1.15.4 to check for unexpected file system modifications.