Executive brief
HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter
Affected products
- Go github.com/hashicorp/go-getter
Junglewise Threat Intelligence
CVE-2025-8959: GO-2025-3892 - HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter
CVE-2025-8959 · Severity: low · CVSS 3.1 · Published 2025-08-29
Technologies: github.com/hashicorp/go-getter (Go). Vendors: Go.
Related threats
- HashiCorp go-getter arbitrary file read via argument injection in Git URLs
- GO-2024-2948 - Code Execution on Git update in github.com/hashicorp/go-getter
- GO-2024-2800 - Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter
- GO-2023-1578 - Denial of service in github.com/hashicorp/go-getter/v2
- GO-2022-0438 - Exposure of sensitive information via log file in github.com/hashicorp/go-getter