CVE-2025-0377: 
Terraform Community vulnerability analysis and mitigation

HashiCorp's go-slug library was found to be vulnerable to a zip-slip style attack, identified as CVE-2025-0377. The vulnerability affects go-slug versions up to 0.16.2 and was disclosed on January 21, 2025. The go-slug library is used for packing and unpacking Terraform Enterprise compatible slugs, which are gzip compressed tar files containing Terraform configuration files (HashiCorp Advisory).

The vulnerability occurs during the extraction process when the filename/extraction path is taken from the tar entry via the header.Name parameter. The unpacking step was found to improperly validate paths, which could lead to path traversal issues. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (Red Hat CVE).

The vulnerability allows an attacker to write arbitrary files during the extraction process, potentially compromising the integrity of the system where these files are extracted. This issue has an impact over the integrity of the system as it can write and over-write arbitrary files on the system where these files are extracted (Red Hat CVE).

Users should upgrade to go-slug version 0.16.3 or later, which contains the fix for this vulnerability. No other mitigation is available for this issue other than updating the affected package to the version containing the fix (HashiCorp Advisory, Red Hat CVE).