| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/hashicorp/go-getter | < 1.7.9 | 1.7.9 |
| go-getter | < 1.7.9 | 1.7.9 |
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free