CVE-2025-0377 HashiCorp go-slug Vulnerable to Zip Slip Attack
Attackers can exploit a zip-slip vulnerability in the go-slug library to write files to arbitrary locations via crafted tar entries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-0377?
CVE-2025-0377 is a high-severity path traversal vulnerability in HashiCorp Shared library, published on 21 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.
Weakness: CWE-59
Which versions are affected by CVE-2025-0377?
3 open source packages ship an affected version, including github.com/hashicorp/go-slug. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hashicorp/go-slug Go | All versions | 0.16.3 |
github.com/hashicorp/go-slug Go | All versions | 0.16.3 |
github.com/hashicorp/go-slug Go | All versions | 0.16.3 |
Linux distribution packages (1)
helmfile openSUSE:Tumbleweed | All versions | 0.170.1-1.1 |
Products include Hashicorp Go-Slug.
How do I fix CVE-2025-0377?
Upgrade github.com/hashicorp/go-slug to 0.16.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-0377 being exploited?
There is no known exploitation of CVE-2025-0377 in the wild and no public exploit code.
Other vulnerabilities in HashiCorp Shared library
Sources
Also known as GHSA-wpfp-cm49-9m9q, GO-2025-3413, ROOT-APP-GOBINARY-CVE-2025-0377, openSUSE-SU-2025:14684-1.