Description
Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Terraform | 1.0.8 – < 1.5.7 | 1.5.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | terraform | 1.3.2-19 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/terraform | >= 1.0.8, < 1.5.7 | 1.5.7 | GHSA-h626-pv66-hhm7 |
Advisories 3
- WID-SEC-2025-0168 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- NCSC-2025-0026 Kwetsbaarheden verholpen in Oracle JD Edwards NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2023-2295 Hashicorp Terraform: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Sep 10, 2023