Listen to this Post
How the CVE Works
CVE-2025-8959 exploits a symlink vulnerability in HashiCorp’s go-getter library when handling subdirectory downloads. Attackers can craft malicious symlinks in downloaded archives, allowing them to read or write files outside the intended directory. The library fails to properly validate symlinks during extraction, leading to directory traversal. This flaw affects versions before 1.7.9, enabling unauthorized access to sensitive system files if exploited.
DailyCVE Form
Platform: HashiCorp go-getter
Version: <1.7.9
Vulnerability: Symlink Attack
Severity: High
Date: Aug 18, 2025
Prediction: Patch expected by Aug 25, 2025
What Undercode Say
Analytics:
$ go-getter -version
$ find / -type l -exec ls -la {} \;
How Exploit
1. Craft malicious archive with symlinks.
2. Trigger download via go-getter.
3. Symlinks redirect extraction outside target dir.
Protection from this CVE
- Upgrade to go-getter 1.7.9+.
- Disable subdirectory downloads if unused.
Impact
- Unauthorized file read/write.
- Potential system compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
