Executive brief
OpenTofu is an open-source infrastructure-as-code tool used to manage cloud resources. A vulnerability in how it handles provider installations could allow an attacker to trick a user into running a command that writes malicious files to unintended locations on their computer. This could lead to unauthorized file modifications or system compromise if the user runs OpenTofu in a directory containing malicious files.
Technical details
A symbolic link (symlink) following vulnerability (CWE-61) exists in OpenTofu's provider installation logic. When 'tofu init' is executed, the installer fails to verify if existing entries in the '.terraform/providers' directory are symlinks before writing package content. If an attacker provides a malicious configuration containing a symlink to a sensitive system directory, OpenTofu will follow that link and write provider package contents to the target location. This requires the attacker to convince a user to run 'tofu init' within an attacker-controlled directory. The issue is fixed in versions 1.11.7, 1.10.10, and 1.12.0.
Affected products
- OpenTofu OpenTofu >= 1.11.0, < 1.11.7; < 1.10.10
Timeline
- 2026-05-21: disclosed
- 2026-06-23: advisory: GitHub Advisory published