CVE-2025-0377

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0377

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

H

ashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

References
Link Resource
https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:hashicorp:go-slug:*:*:*:*:*:*:*:*
History

15 Dec 2025, 21:00

Type Values Removed Values Added
CPE cpe:2.3:a:hashicorp:go-slug:*:*:*:*:*:*:*:*
Summary
  • (es) El go-slug librería de HashiCorp es vulnerable a un ataque de estilo zip-slip cuando se extrae una ruta proporcionada por el usuario que no existe de la entrada tar.
First Time Hashicorp go-slug
Hashicorp
References () https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack - () https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack - Vendor Advisory

21 Jan 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-21 16:15

Updated : 2025-12-15 21:00

NVD link : CVE-2025-0377

Mitre link : CVE-2025-0377

CVE.ORG link : CVE-2025-0377

JSON object : View

Products Affected

hashicorp

CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')