CVE-2023-4782: Arbitrary File Write Vulnerability in Terraform
Summary
CVE-2023-4782: Terraform allows arbitrary file write during the init operation. Affects github.com/hashicorp/terraform versions >= 1.0.8, < 1.5.7. Fixed in 1.5.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Terraform is an open-source infrastructure as code software tool created by HashiCorp. It allows users to define and provision infrastructure resources in a declarative manner. Terraform is widely used for managing cloud infrastructure and is written in the Go programming language. This vulnerability affects Terraform versions 1.0.8 through 1.5.6.
Vulnerability Detail
The vulnerability in Terraform allows for arbitrary file write during the init operation when executed on a maliciously crafted Terraform configuration. An attacker can exploit this vulnerability to write arbitrary files on the system, potentially leading to unauthorized access, data leakage, or further compromise of the infrastructure. The vulnerability has a CVSS score of 6.3, indicating a moderate severity level.
How To Fix
Latest published version: v1.17.0 as of 22 Oct 2026
go get github.com/hashicorp/terraform@v1.17.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.7
This is the first release that contains the fix.
go get github.com/hashicorp/terraform@v1.5.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating to the latest version of Terraform.
Conclusion
The arbitrary file write vulnerability in Terraform can be mitigated by updating to version 1.5.7 or later. It is crucial to promptly apply this fix to prevent potential unauthorized access or compromise of infrastructure resources. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/terraform →
FAQ
Terraform is an open-source infrastructure as code software tool used for provisioning and managing cloud infrastructure resources.
The vulnerability allows an attacker to write arbitrary files during the init operation, potentially leading to unauthorized access, data leakage, or further compromise of the infrastructure.
Terraform versions 1.0.8 through 1.5.6 are affected by this vulnerability.
To fix this vulnerability, update your Terraform installation to version 1.5.7 or later.
There is no known workaround for this vulnerability. It is recommended to update to the latest version of Terraform.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/terraform.
