VYPR
← All advisories
High severityNVD Advisory· Published Jan 21, 2025· Updated Feb 12, 2025

HashiCorp go-slug Vulnerable to Zip Slip Attack

CVE-2025-0377

Description

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

HashiCorp's go-slug library before 0.16.3 is vulnerable to a zip-slip style path traversal when extracting tar entries, allowing arbitrary file writes.

Root

Cause The vulnerability resides in how go-slug handles tar entry extraction. When unpacking a gzip-compressed tar (slug), the library uses header.Name from the tar entry as the destination path without proper validation. If the tar entry specifies a non-existing path containing directory traversal sequences, the extraction does not safely resolve it, leading to a zip-slip style attack [1][2].

Exploitation

Prerequisites An attacker must supply a maliciously crafted tar archive that includes tar entries with path traversal prefixes (e.g., ../../). The target application must use the go-slug library to extract user-supplied slugs. No additional authentication is required if the application processes untrusted archives. The attack is performed by including a tar entry whose name points to a non-existing parent directory, allowing the traversal check to be bypassed [2].

Impact

Successful exploitation allows an attacker to write arbitrary files at arbitrary locations within the file system where the extraction process has write permissions. This could lead to overwriting critical system files, injecting malicious executables, or modifying application configuration, potentially resulting in code execution or privilege escalation [1][2].

Mitigation

The vulnerability is fixed in go-slug version 0.16.3. Users should upgrade to this version or later. There is no known workaround; the fix improves path validation during extraction to prevent traversal. HashiCorp has credited their Product Security team for discovering the issue [2].

References
  1. NVD - CVE-2025-0377
  2. HCSEC-2025-01 - HashiCorp go-slug Vulnerable to Zip Slip Attack

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/hashicorp/go-slugGo
< 0.16.30.16.3

Affected products

64

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

4

News mentions

0

No linked articles in our index yet.