GO-2025-3892

Affected Products

Timeline

• Aug 29, 2025 CVE Published
• Feb 4, 2026 CVE Updated

References

• https://github.com/advisories/GHSA-wjrx-6529-hcj3 advisory
• https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76242 url
• https://github.com/hashicorp/go-getter/commit/87541b2501c00df5eaedea6acc61a2a4a4efa5b7 fix