HashiCorp’s go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-8959 |
Exploitation
To exploit this vulnerability, an attacker can create a symlink in a subdirectory that points to a sensitive file outside the designated directory boundaries. When the go-getter library processes the subdirectory download, it may inadvertently grant unauthorized read access to the linked file, allowing the attacker to access sensitive information.
Affected Products
- Go-getter: A library used for downloading files and directories, which is vulnerable to symlink attacks.
Mitigation
To mitigate this vulnerability, users should upgrade to go-getter version 1.7.9 or later, which includes the necessary fixes to prevent symlink attacks. Additionally, implementing strict access controls and validating file paths can help reduce the risk of similar vulnerabilities.