Vault and Vault Enterprise failed to verify that plugin catalog entries referenced binaries inside the user‑configured plugin directory. If the system uses Shamir seals and an external plugin directory, a privileged operator who restores a Raft snapshot can cause Vault to load an unintended plugin binary, resulting in arbitrary code execution on the Vault host. This grants the attacker complete control, including the ability to read or modify all stored secrets and system configuration, effectively compromising the entire Vault deployment. The weakness aligns with CWE‑22, which relates to improper validation of file paths or directory traversal.

The affected products are HashiCorp Vault and HashiCorp Vault Enterprise. Versions prior to the fix are vulnerable; the vulnerability is remedied in Vault Community Edition 2.1.2 and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Any deployment using earlier builds with Shamir seals and an external plugin directory is at risk.

The CVSS score of 8 classifies the issue as high severity. Although the EPSS score is not available, the vulnerability requires privileged snapshot restoration, which is an internal or administrative privilege. As it is not listed in the CISA KEV catalog, there is no evidence of widespread exploitation yet; however, the potential impact and the prerequisite of operator access make it a significant risk for environments using Raft snapshots for state replication.