CVE-2025-8959: hashicorp go-getter Link Following
CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2025-8959DEBIAN-CVE-2025-8959CGA-2375-769j-wpcrCGA-26vw-jm3q-x832CGA-2qxx-mf8j-2fj8CGA-3cw3-p2g9-4ph5CGA-3q73-4r7g-xv8hCGA-423h-h6r2-ggcvCGA-45v6-gjx7-94q5CGA-468r-x644-vx4vCGA-4q57-rv86-jvjmCGA-4vvr-rr9h-299fCGA-542w-xwp8-8f89CGA-55r4-4h4f-hq9wCGA-694x-jpxh-8rh4CGA-7jvv-h4g5-p7v5CGA-829x-7vq2-2hw5CGA-83m8-h6xr-fmg5CGA-886v-w7r5-r6g9CGA-94qv-qfr7-x8pqCGA-98vc-gww8-fcfcCGA-9xrq-9w6r-7jmqCGA-cjff-f28x-2m93CGA-cp78-c8r5-fjx7CGA-f4hp-jrqh-mww8CGA-f5ff-qf6r-j4qgCGA-f9p8-8gcf-jfxwCGA-fvq9-r9hm-x96mCGA-g5q6-fvvp-594fCGA-g793-h3f2-4vxxCGA-h876-4qxm-c3gxCGA-hvwr-h657-j3pjCGA-j458-mjgg-mr6jCGA-j4gj-63qg-rcmmCGA-j82h-9v96-xh5pCGA-j938-2xxq-769jCGA-jpwr-j4wf-fq5wCGA-mhcc-cr48-xfx2CGA-mvjx-9cxv-c39hCGA-mvm3-8j45-2pvwCGA-mxf6-xmh9-q5g7CGA-ppj4-jggj-rmxcCGA-pqxj-28v8-9473CGA-qrgx-mhf3-54vhCGA-qx35-4qw4-m522CGA-qxgr-cx9c-74j5CGA-r3v3-9c7r-rxmfCGA-v4jr-x42p-2vwvCGA-v6g5-hq92-9x93CGA-vfxm-gfg3-97j2CGA-vm83-cmrw-4cjgCGA-vmjf-r8hh-gjq6CGA-vp85-gcc5-c8h3CGA-vq4m-2jj9-rj6qCGA-w755-qj9f-v79mCGA-wh7r-gv8m-8f7gCGA-wmcx-pp86-3g2rCGA-wqmm-xqmg-mr36CGA-wqrg-c4vq-mf5hCGA-x2qh-ch9w-xrqwCGA-x3xm-crw2-p926CGA-x93w-c65g-qjf8GHSA-wjrx-6529-hcj3GO-2025-3892openSUSE-SU-2025:15485-1CGA-26qx-j6xx-xqfvCGA-29xp-h8hh-2552CGA-2hvj-rr7h-475qCGA-2xx3-qvc5-4g64CGA-398p-w5q9-g6rxCGA-49m3-rj47-j5jjCGA-4mqw-j84v-8qmgCGA-4rqc-h8wh-87w3CGA-4w26-f4pp-jj5cCGA-52xf-q3pm-w4fvCGA-5c6w-xpq6-72q7CGA-5f5w-rfr7-wvh2CGA-5hxp-7rrc-9qhmCGA-5q67-cj3c-x3hvCGA-5r8r-2gxg-q784CGA-642p-88m9-gvv8CGA-67fx-p9pf-xq3pCGA-6g78-7ppv-7349CGA-6jpf-m5hp-49f3CGA-6pw4-6r7w-6vfpCGA-76hj-h787-p5hrCGA-77r2-gjv7-c6jpCGA-7mjf-hmf8-w4jxCGA-8h5f-cw3w-qgq7CGA-8q2g-j9w3-mvxfCGA-8q2w-7hrm-4rrvCGA-8x3g-ph6p-4r75CGA-9f87-c2v8-gm58CGA-9hrh-m8rp-xx54CGA-c7wr-pvp6-vchwCGA-cmfg-63hg-74gqCGA-cwwj-f7w5-v629CGA-f245-3w3r-qcrjCGA-f46x-2jj4-gv8fCGA-f7q8-ghcx-fcp9CGA-f7rq-ppmm-783qCGA-f8fv-cxr9-h223CGA-fcr6-95w6-g29vCGA-ff86-422p-qcm7CGA-fhhq-ccjp-7vppCGA-fm7w-74pr-8hw8CGA-fmrw-gj6p-jw96CGA-fwrc-49wf-c84gCGA-ggh9-5v9m-jw6hCGA-ggxc-7h93-wx5cCGA-gpvp-5phr-9h2jCGA-gwh4-p8cv-9g7cCGA-h22g-v7vw-89xvCGA-h783-hq9r-vmmcCGA-h83q-wcj5-566xCGA-hr5g-xgvm-6jx7CGA-hwr7-f7jf-2qx3CGA-j5h3-6g9v-q6hfCGA-jchr-xm2g-cm8hCGA-jfm5-cr54-4m95CGA-jwm5-rg92-7crxCGA-mg75-8wqf-rf76CGA-mqpg-jwx7-vvq8CGA-mrfv-8q67-p4q9CGA-p6g8-h7gh-87gpCGA-ppfg-wch4-649mCGA-pqf5-fx4p-8pm2CGA-pw9v-ffgq-v2x8CGA-q43m-82vj-649wCGA-q4hc-ggq6-77xvCGA-q68m-39rq-wcwvCGA-q79h-8p39-6hrmCGA-q7rp-vr27-87m8CGA-q8r3-r49h-g29rCGA-qp8m-x4vf-7ph3CGA-qqhr-vrqm-5mg2CGA-qw46-hwjp-vc6jCGA-r39h-vch9-fmhvCGA-r8hg-q8hx-9r45CGA-r93p-wfxf-8gccCGA-rwg3-85f7-c4qhCGA-v7cp-jpp6-vp8mCGA-vc6g-gw9m-m5q7CGA-vmxw-9653-7q69CGA-vp2w-36rj-h26cCGA-vw62-29g3-cf9vCGA-w8wq-442v-3p96CGA-wfcc-7hwf-rv5gCGA-wjx8-rgrh-xwj5CGA-wpj8-wjh9-3rj3CGA-wwgv-m26p-3g24CGA-wxqq-wx4m-48c3CGA-xh2x-52hr-9862CGA-xp76-33hg-r52rCGA-xqr5-m4f4-7r8m
Published 15-08-2025Last modified 15-08-2025
Vulnerability summary
CVE-2025-8959 is a high (CVSS 7.5) Link Following vulnerability in hashicorp go-getter. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.57%
0%100%
Low · +0.03 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 35CGA-2GRG-C24R-89VPCGA-2JXG-W7VP-M24FCGA-2W2P-4H68-V3H7CGA-3G7W-8XXG-GWFCCGA-3MCH-HJ4R-WW43CGA-3V76-RQ79-VRQJCGA-4499-9FX3-47G2CGA-477X-GRPJ-93QQCGA-49QW-HHWH-PXJQCGA-4GHX-3WXM-P27HCGA-4Q7F-MH23-XPJCCGA-662V-F77H-JXR8CGA-6GCG-W9M4-XM8HCGA-845H-WMJX-5394CGA-8FMX-94F7-H6VWCGA-93Q9-CWXQ-C2V7CGA-93X3-3J6H-82XHCGA-99PR-PC6J-8VVRCGA-9F98-4W6H-JHV9CGA-9XXX-9H46-9RM7CGA-F7GJ-HQM7-7V54CGA-G34C-MHWF-3536CGA-GVFX-4843-PGMVCGA-JJ94-W5MX-F3CXCGA-JM5H-RMM2-JQG2CGA-P2XP-V76P-G8M5CGA-P84C-2QXC-JCP7CGA-P84W-98X7-3HGPCGA-PXX7-FRJ4-CF43CGA-R547-XVM6-8853CGA-V3HM-26CQ-7RW2CGA-WV7H-8GRJ-88RPCGA-X4M3-RXRF-H7MMCGA-X4PQ-WWG5-WMWCCGA-XH8G-VJ86-HWMV
Timeline
- 15-08-2025PublishedVulnerability first disclosed.
- 15-08-2025Last modifiedVulnerability information updated.
Description
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.03 pp
From 0.54% on 20-09-2026
20-09-202620-10-2026
EPSS score0.57%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard75 products
- chainctl< 0.2.126-r0
- cloudbeat-9.0< 9.0.8-r16
- cloudbeat-fips-8.17< 8.17.10-r20
- cloudbeat-fips-9.0< 9.0.8-r18
- conftest< 0.62.0-r3
Wolfi30 products
- conftest< 0.62.0-r3
- grype< 0.98.0-r1
- k9s< 0.50.9-r6
- kots< 1.126.0-r1
- kots-compat< 1.126.0-r1
Hashicorp2 products
- go-getter< 1.7.9
- shared library< 1.7.8
Debian1 product
- golang-github-hashicorp-go-getterAll versions (No fix recorded)
Github.com/hashicorp1 product
- go-getter< 1.7.9
Opensuse1 product
- terragrunt&distro=openSUSE Tumbleweed< 0.85.1-1.1
Ubuntu1 product
- golang-github-hashicorp-go-getterAll versions (No fix recorded)
7 vendors · 111 products
