CVE-2025-8959 HIGH

CVE-2025-8959: HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

Vendor Hashicorp

Product Shared library

Weakness CWE-59

Published August 15, 2025

Last update August 15, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

Key dates

02Disclosure timeline

August 15, 2025 CVE published

August 15, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-8959 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/59.html

Related vulnerabilities

04Related CVE

CVE-2026-42795 Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root CVE-2025-15318 Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools. CVE-2025-4211 Improper Link Resolution Before File Access in QFileSystemEngine on Windows CVE-2026-5061 Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack CVE-2026-54056 Kitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging