CVE-2026-105816: CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in HashiCorp Vault

HashiCorp Vault and Vault Enterprise versions prior to 2.1.2 (Community Edition) and prior to 2.1.2, 1.21.12, 1.20.17, and 1.19.23 (Enterprise Editions) contain a CWE-22 path traversal vulnerability. The vulnerability occurs because Vault does not consistently enforce that plugin catalog entries point only to binaries within the configured plugin directory. When Vault uses Shamir seals and an external plugin directory is configured, a privileged operator restoring an Integrated Storage (Raft) snapshot could exploit this flaw to execute arbitrary code on the Vault host. This issue is addressed in the specified patched versions.

A successful exploitation of this vulnerability allows a privileged operator with the ability to restore an Integrated Storage snapshot to execute arbitrary code on the Vault host, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability, as reflected by the CVSS score of 8.0 (high severity).

This vulnerability is fixed in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Users should upgrade to these versions or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.