OpenTofu fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory, causing tofu init to write provider package contents to arbitrary filesystem locations outside the working tree. This flaw enables an attacker to perform an arbitrary file‑write attack.

Versions of OpenTofu before .11.7 are affected. The issue exists in all installations that employ the default provider cache directory during initialization, regardless of operating system.

The CVSS score of 7 indicates high severity. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of active exploitation yet. Attackers can execute tofu init with a prepared working directory containing a malicious symlink, achieving a local file‑write attack that can affect system integrity and availability. The exploit requires the ability to place a symlink, after which the process writes files to arbitrary paths.