CVE-2025-8959: HashiCorp go-getter Symlink Attack Vulnerability
Summary
CVE-2025-8959: HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter. Affects github.com/hashicorp/go-getter versions < 1.7.9. Fixed in 1.7.9. How to fix ↓
Also tracked for
- golang-github-hashicorp-go-getter · Debian:11
The same CVE-2025-8959 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp go-getter is a Go library designed for downloading files from various sources, including Git repositories, HTTP servers, and more. It simplifies the process of fetching and managing remote resources, making it a popular choice for developers. However, it has been found to be vulnerable to symlink attacks, which can lead to unauthorized file access and potential system compromise.
Vulnerability Detail
The vulnerability arises from the way go-getter handles file downloads and storage. Specifically, it does not adequately validate the paths of files being downloaded, allowing attackers to create symbolic links that point to sensitive files on the system. If a user downloads a maliciously crafted resource, it could overwrite or expose critical files, leading to data loss or unauthorized access. This vulnerability affects multiple functions within the library, including Client.Get and HttpGetter.Get, making it a significant risk for applications relying on go-getter.
How To Fix
Latest published version: v1.8.10 as of 23 Oct 2026
go get github.com/hashicorp/go-getter@v1.8.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.9
This is the first release that contains the fix.
go get github.com/hashicorp/go-getter@v1.7.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected functions in the go-getter library until you can update to the patched version. Additionally, ensure that your application has proper file permissions and validation checks in place to mitigate the risk of symlink attacks.
Conclusion
The HashiCorp go-getter library is vulnerable to symlink attacks, which can lead to significant security risks. It is crucial for developers using this library to update to version 1.7.9 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for github.com/hashicorp/go-getter →
FAQ
A symlink attack occurs when an attacker creates a symbolic link that points to a sensitive file or directory. When a program follows this link, it may inadvertently access or modify the target file, leading to potential data breaches or system compromise.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Gopkg.lock file without any signup.
Failing to fix this vulnerability could lead to unauthorized access to sensitive files, data loss, or even complete system compromise, depending on the permissions of the affected files.
Yes, you can implement additional file permission checks and avoid using the vulnerable functions until you can update to the patched version.
More information can be found in the official vulnerability report at https://pkg.go.dev/vuln/GO-2025-3892.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/go-getter.
