CVE-2025-8959

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

References

Affected packages

Debian:11 / golang-github-hashicorp-go-getter

Package

Name: golang-github-hashicorp-go-getter
Purl: pkg:deb/debian/golang-github-hashicorp-go-getter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.4.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / golang-github-hashicorp-go-getter

Package

Name: golang-github-hashicorp-go-getter
Purl: pkg:deb/debian/golang-github-hashicorp-go-getter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.4.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}