CVE-2026-19589

HIGH 7.1

Packer vulnerable to arbitrary file write via crafted plugin archive during installation

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability (CVE-2026-19589) is fixed in Packer 1.16.0.

CWE	CWE-22
Vendor	hashicorp
Product	packer
Published	Aug 17, 2026
Last Updated	Aug 17, 2026

Stay Ahead of the Next One

Get instant alerts for hashicorp packer

Be the first to know when new high vulnerabilities affecting hashicorp packer are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

HashiCorp / Packer

1.7.0 < 1.16.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

discuss.hashicorp.com: https://discuss.hashicorp.com/t/hcsec-2026-29-packer-vulnerable-to-arbitrary-file-write-via-crafted-plugin-archive-during-installation/77654

Credits

This issue was reported to HashiCorp by George Chen.