Insecure session management In golang-github-hashicorp-go-getter
Description
HashiCorp go-getter Vulnerable to Symlink Attacks HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | - | ||
debian 11 | - | ||
 go | 1.7.9 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3.