7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-8959

CVE-2025-8959: HashiCorp go-getter Vulnerable to Symlink Attacks

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-8959

CVE-2025-8959:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/hashicorp/go-getter	go	< 1.7.9	1.7.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the copyDir function in copy_dir.go, which is responsible for copying directories. The function resolves symbolic links but, prior to the patch, did not perform any validation to ensure that the resolved path of the symlink remained within the intended source directory. This created a path traversal vulnerability.

The patch addresses this by adding a check immediately after resolving the symlink. It computes the relative path and verifies that it does not traverse upwards (i.e., contain '..') or point to an absolute path, thus constraining the file operations within the intended directory boundaries.

The GitGetter.fetchSubmodules function in get_git.go was also modified to explicitly set DisableSymlinks = true on the client it uses. This indicates that fetching git submodules was an attack vector that could trigger the vulnerable file copying logic in copyDir. By enabling this flag, the fix is propagated to the submodule handling logic.

The analysis of the fixing commit 87541b2501c00df5eaedea6acc61a2a4a4efa5b7 provides clear evidence of these changes. The core of the vulnerability is in copyDir, and GitGetter.fetchSubmodules is a function that would appear in a runtime profile during an exploit scenario involving git submodules.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.