The vulnerability resides in HashiCorp’s go‑getter library version 1.8.5 and earlier. A specially crafted git URL can cause the library to resolve paths that lead outside the intended repository, allowing the caller to read arbitrary files on the host file system. Attackers could thus obtain sensitive configuration files or secrets, resulting in accidental disclosure of confidential data. The weakness is reflected by CWE‑200 (Information Exposure) and CWE‑22 (Path Traversal).

Affected systems include any HashiCorp tooling that uses go‑getter up to and including v1.8.5, such as HashiCorp infrastructure automation products that import modules or plugins via git. The vulnerability does not affect the go‑getter/v2 package, nor versions 1.8.6 and later, which are already patched.

The CVSS score of 7.5 indicates a medium‑to‑high severity, while the lack of an EPSS score suggests insufficient public exploitation data. The issue is not yet listed in CISA’s KEV catalog. The exploit would require the attacker to supply a malicious git URL; thus, attackers could target assets during provisioning or module fetch operations. The path traversal is not provided by a web interface by default, implying that the attack vector is likely restricted to automated or scripted Git operations, potentially through supply‑chain manipulation or social engineering.