Packer up to version 1.15.4 contains a flaw in its third‑party plugin installer that allows an attacker to supply a crafted plugin archive. The installer writes files to locations specified in the archive, enabling arbitrary file writes on the host file system. If the attacker includes malicious payloads or alters configuration files, the plugin installation could execute code on the target machine. The weakness is identified as CWE‑22, which describes path traversal and arbitrary file related attacks.

HashiCorp Packer releases up to and including version 1.15.4 are vulnerable. The issue was fixed in version 1.16.0.

The CVSS score of 7.1 marks the vulnerability as high risk. EPSS data for this CVE is not available, and it is not listed in the CISA KEV catalog. The most likely attack scenario involves a user installing a plugin from a malicious or compromised source. The attacker must provide a crafted plugin archive; when the installer processes it, the arbitrary file write can be used to place executable payloads on the system. While no publicly available exploit is reported, the flaw can be exercised manually by an individual with access to the installer.