CVE-2025-0377

CVE-2025-0377 is a path traversal vulnerability (CWE-59) in HashiCorp's go-slug library, enabling a zip-slip style attack during tar archive extraction. The flaw arises when a non-existing user-provided path in a tar entry is processed, allowing traversal outside intended directories. Published on 2025-01-21, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity primarily due to confidentiality risks.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction. By supplying a malicious tar archive, they can traverse paths to access sensitive files, achieving high-impact unauthorized disclosure of information without altering integrity or availability.

HashiCorp's security advisory (HCSEC-2025-01) provides details on the issue and mitigation at https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack.