CVE-2023-4782: Arbitrary File Write Vulnerability in Terraform
Summary
CVE-2023-4782: Terraform allows arbitrary file write during the init operation in github.com/hashicorp/terraform. Affects github.com/hashicorp/terraform versions >= 1.0.8, < 1.5.7. Fixed in 1.5.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Terraform is an open-source infrastructure as code software tool developed by HashiCorp. It allows users to define and provision infrastructure resources in a declarative configuration language. Terraform is widely used for managing cloud infrastructure and has a large ecosystem of providers and modules. However, a vulnerability has been discovered in Terraform that allows arbitrary file write during the init operation.
Vulnerability Detail
The vulnerability in Terraform allows an attacker to write arbitrary files during the init operation. This can lead to unauthorized modifications to the infrastructure configuration or the execution of malicious code. The vulnerability exists in versions 1.0.8 and earlier of the github.com/hashicorp/terraform package. It has been fixed in version 1.5.7.
How To Fix
Latest published version: v1.17.0 as of 22 Oct 2026
go get github.com/hashicorp/terraform@v1.17.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.7
This is the first release that contains the fix.
go get github.com/hashicorp/terraform@v1.5.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version as soon as possible.
Conclusion
The arbitrary file write vulnerability in Terraform can have serious consequences, allowing attackers to modify infrastructure configurations or execute malicious code. Users should update to version 1.5.7 or later to mitigate this vulnerability.
See every vulnerability recorded for github.com/hashicorp/terraform →
FAQ
Terraform is an open-source infrastructure as code software tool developed by HashiCorp. It allows users to define and provision infrastructure resources in a declarative configuration language.
The vulnerability allows an attacker to write arbitrary files during the init operation in Terraform. This can lead to unauthorized modifications to the infrastructure configuration or the execution of malicious code.
Versions 1.0.8 and earlier of the github.com/hashicorp/terraform package are affected by this vulnerability.
To fix the vulnerability, update your Terraform installation to version 1.5.7 or later.
There is no known workaround for this vulnerability. It is recommended to update to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/terraform.
