CVE-2025-8959highCWE-59

CVE-2025-8959: fallo de gravedad alta en HashiCorp Shared library

HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

Publicada el

Seguir esta CVE+ Monitorear Shared library+ Monitorear golang-github-hashicorp-go-getter

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.6%
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
HashiCorp · Shared library
CVEs relacionadas — HashiCorp Shared library

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-3817CRITICALHashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git BranchesEPSS 1.3%CVE-2024-6257HIGHHashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config ManipulationEPSS 1.0%CVE-2025-0377HIGHHashiCorp go-slug Vulnerable to Zip Slip AttackEPSS 0.7%CVE-2026-0969HIGHArbitrary code execution in React server-side rendering of untrusted MDX contentEPSS 0.6%CVE-2024-6104MEDIUMgo-retryablehttp can leak basic auth credentials to log filesEPSS 0.4%CVE-2026-14362MEDIUMDenial of service via crafted push/pull gossip message in memberlistEPSS 0.3%