CVE-2025-8959 HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

What is CVE-2025-8959?

CVE-2025-8959 is a high-severity path traversal vulnerability in HashiCorp Shared library, published on 15 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

Weakness: CWE-59

Which versions are affected by CVE-2025-8959?

3 open source packages ship an affected version, including github.com/hashicorp/go-getter. It affects 1 product.

Products include Hashicorp Go-Getter.

How do I fix CVE-2025-8959?

Upgrade github.com/hashicorp/go-getter to 1.7.9 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-8959 being exploited?

There is no known exploitation of CVE-2025-8959 in the wild and no public exploit code.

Other vulnerabilities in HashiCorp Shared library

• CVE-2024-3817 HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches Critical 9.8
• CVE-2022-26945 Server-side request forgery in n/a Critical 9.8
• CVE-2022-30321 Path traversal in n/a High 8.6
• CVE-2022-30322 Denial of service in n/a High 8.6
• CVE-2022-30323 Denial of service in n/a High 8.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2025-8959, CLEANSTART-2026-BJ71317, DEBIAN-CVE-2025-8959, GHSA-wjrx-6529-hcj3, GO-2025-3892, MINI-7q9q-grfc-38gr and 11 more.