CVE-2025-8959

What it actually does

HashiCorp go-getter’s subdirectory download path does not adequately constrain symbolic-link resolution. When fetching a subdirectory from a Git repository, HTTP archive, or similar source, crafted symlinks inside that tree can be followed, causing the client to read files outside the designated destination directory and resulting in unauthorized local file disclosure on the host performing the download.

Why it matters to the business

Build agents, developer workstations, and CI/CD jobs that pull modules or artifacts through go-getter (including downstream HashiCorp tooling such as Terraform and Packer) may leak secrets, credentials, private keys, or configuration from the host into working directories, logs, or published artifacts. The issue is information disclosure rather than remote code execution. It is not listed in CISA KEV, no public exploit is known, and EPSS remains low (~0.57% with a modest +5% 30-day rise). Residual risk is driven by how widely go-getter is vendored, not by active campaigns.

How an attack unfolds

An attacker publishes or compromises a remote source that victims fetch with go-getter. The source contains a subdirectory whose contents include symbolic links pointing outside the extracted tree (for example toward credential files or host configuration). When a user or automation job uses the subdirectory download feature against that source, the library follows the links and copies or exposes host files beyond the intended directory. The attacker then obtains the leaked material if the download output is committed, logged, packaged, or otherwise returned. No named threat actors or ransomware campaigns are associated with this CVE, and exploit maturity is none.

How to fix it

Upgrade hashicorp/go-getter to 1.7.9 or later, which includes the fix at commit e70221100018573cdc74411c95c19b2a372f6728. Rebuild and redeploy every binary that vendors or module-pins go-getter. Update go.mod/go.sum (and any lockfiles or vendor directories) so no pre-1.7.9 copy remains. Restrict go-getter sources to trusted origins and treat untrusted subdirectory downloads as high risk until all dependents are upgraded.

How to confirm the fix worked

Confirm go-getter is at 1.7.9 or newer in module files, vendor trees, container images, and compiled binaries (for example via go version -m). Run software composition analysis across repositories and release artifacts. After upgrade, verify that subdirectory fetches from archives or repositories containing outbound symlinks no longer copy files outside the destination directory, and that CI jobs using Terraform, Packer, or custom go-getter callers pick up the rebuilt binaries.

Typical attack path

1. Attacker prepares a Git repository or archive whose subdirectory contains outbound symbolic links.
2. Victim process (application, Terraform/Packer-style workflow, or CI job) invokes go-getter subdirectory download against that source.
3. go-getter follows the links and reads files outside the designated destination.
4. Sensitive content is written into the working tree, cache, logs, or build artifacts.
5. Attacker recovers the disclosed files from a subsequent artifact, repository, or error output.

How to detect it

No in-the-wild exploitation is reported and exploit maturity is none, so hunting is retrospective and low-signal. Review CI and local logs for go-getter, Terraform, or Packer fetches of subdirectories from untrusted Git or HTTP sources, especially around and after 2025-08-15. Inspect destination and cache directories for unexpected symbolic links whose targets resolve outside the download root, and for host files (credentials, keys, configuration) that appeared in module or artifact trees after a get. Correlate process file-access during get operations with reads of sensitive paths. Absence of those artifacts does not prove the host was never exposed.

What your security team should do

• Inventory all first-party and third-party binaries that import hashicorp/go-getter and identify versions below 1.7.9.
• Prioritize upgrades of CI runners, module caches, and developer tooling that fetch remote subdirectories.
• Pin and rebuild to go-getter 1.7.9 (commit e70221100018573cdc74411c95c19b2a372f6728) and block pre-fix versions in dependency policy.
• Limit go-getter to allowlisted, trusted remotes until upgrades are complete.
• Because EPSS is low, KEV is false, and no public exploit exists, treat this as a standard dependency-hygiene item rather than an emergency incident, but do not leave long-lived unpatched images in production.
• Review recent download working trees for unexpected files that may indicate prior symlink follow.