CVE-2026-93992 is a path traversal vulnerability in GopeedLab gopeed through version 2.0.0-beta.3. The vulnerability exists in the archive extraction functionality, where attackers can create specially crafted archives containing directory traversal sequences. These sequences bypass validation checks, enabling the extraction process to write files arbitrarily outside the designated extraction directory when AutoExtract is enabled.

Successful exploitation allows an attacker to write arbitrary files outside the intended extraction directory. This can lead to unauthorized file modification or creation, potentially impacting system integrity and security. The vulnerability requires user interaction (UI:A) and network access (AV:N), but no privileges or authentication are needed. The impact on confidentiality and integrity is high, while availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the AutoExtract feature or avoid extracting untrusted archives to prevent exploitation.