A path traversal vulnerability in HashiCorp Nomad and Nomad Enterprise allows an attacker to overwrite or read arbitrary files on the client host. The flaw, identified as CWE‑22, can lead to arbitrary code execution, granting full control over the affected system. The vulnerability is classified with a CVSS score of 8.8, indicating a high severity impact on confidentiality, integrity, and availability.

All versions of HashiCorp Nomad and Nomad Enterprise released prior to 2.0.1, 1.11.5, and 1.10.11 are affected. The defect exists in the handling of dynamic host volumes and is fixed in the mentioned releases.

Because the vulnerability relies on path traversal within dynamic host volumes, an attacker who can influence volume configuration or file creation may execute arbitrary commands on the client host. The EPSS score is not available, so the current exploitation probability is unclear; however, the high CVSS score and public disclosure warrant immediate attention. The vulnerability is not listed in CISA’s KEV catalog, but its severity and potential for remote code execution make it a high‑priority risk.