CVE-2025-8959

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@hashicorp.com

Published

2025-08-15

Last modified

2025-08-15

Weaknesses

CWE-59

Affected products

• Go-getter (Hashicorp)
• Shared Library (Hashicorp)

References

• https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/7…