HashiCorp go-getter Symlink Attack Vulnerability Leading to Unauthorized Read Access

A vulnerability in HashiCorp's go-getter library, affecting versions prior to 1.7.8, allows symlink attacks that could result in unauthorized read access beyond specified directory boundaries. This issue arises when symbolic links in the source repository are followed during the extraction process, enabling access to unintended areas of the filesystem.

Impact

Exploitation of this vulnerability could lead to arbitrary file read access outside the intended directory boundaries, potentially exposing sensitive information.

Remediation

Users of the go-getter library should upgrade to version 1.7.9 or later. The latest releases can be found on the HashiCorp go-getter GitHub releases page.