GHSA-q7j3-v8qv-22vq: OpenTofu Possible Arbitrary File Read During Vulnerability

HIGH
Share
CVSS 7.5
CWE-1395
Published
Advisory Summary

GHSA-q7j3-v8qv-22vq is a HIGH (CVSS 7.5) possible arbitrary file read during vulnerability (CWE-1395: Dependency on Vulnerable Third-Party Component) affecting OpenTofu libraries in the Go ecosystem. The issue involves possible arbitrary file read during certain git operations via a maliciously crafted url. Remediation is available by upgrading affected packages to version 1.11.10, 1.12.3.

GHSA-q7j3-v8qv-22vq at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-q7j3-v8qv-22vq
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-1395: Dependency on Vulnerable Third-Party Component
Affected Product OpenTofu
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability None (A:N)

How to Fix GHSA-q7j3-v8qv-22vq

To remediate this vulnerability, upgrade all affected OpenTofu dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/opentofu/opentofu fixed: 1.11.10 
Upgrade github.com/opentofu/opentofu to 1.11.10
github.com/opentofu/opentofu fixed: 1.12.3 
Upgrade github.com/opentofu/opentofu to 1.12.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/opentofu/opentofu

How to Check if You Are Affected

To determine whether your application is affected by GHSA-q7j3-v8qv-22vq, inspect your project dependencies for OpenTofu:

inspect dependencies for github.com/opentofu/opentofu

Analyze the terminal output to locate any version of OpenTofu in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.11.10), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1395: Dependency on Vulnerable Third-Party Component, where the product has a dependency on a third-party component that contains one or more known vulnerabilities. In OpenTofu, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Possible data exposure. #### Summary While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information. #### Details OpenTofu relies on [go-getter](https://github.com/hashicorp/go-getter) for downloading packages like providers and modules. While doing so from a maliciously crafted URL, the operator could be affected by confidential information disclosure. The go-getter maintainers have recently published [CVE-2026-4660](https://github.com/advisories/GHSA-92mm-2pjq-r785) for this library which indirectly affects OpenTofu's behavior. Typical use of OpenTofu already requires caution in selection of URLs that are used to download modules and providers. ### Patches OpenTofu v1.11.10 and v1.12.3 address these vulnerabilities by upgrading to the [hashicorp/go-getter@v1.8.6](https://github.com/hashicorp/go-getter/releases/tag/v1.8.6) that fixes this vulnerability. The OpenTofu v1.10 series is also impacted by these vulnerabilities. However, that series is built with an older version of the library and upgrading it risks breaking the whole v1.10 series. For those using OpenTofu v1.10 releases, we recommend planning an upgrade to OpenTofu v1.11.10 in the near future. ### References * [Initial report](https://github.com/opentofu/opentofu/pull/4288) * [CVE-2026-4660](https://github.com/advisories/GHSA-92mm-2pjq-r785) * [OpenTofu v1.12 patch](https://github.com/opentofu/opentofu/pull/4293) * [OpenTofu v1.11 patch](https://github.com/opentofu/opentofu/pull/4292) * [Patched v1.12.3 version](https://github.com/opentofu/opentofu/releases/tag/v1.12.3) * [Patched v1.11.10 version](https://github.com/opentofu/opentofu/releases/tag/v1.11.10)

GHSA-q7j3-v8qv-22vq Affected OpenTofu Versions

2 component(s)
Fixed Versions:
1.11.101.12.3
Product / Package Ecosystem Affected Versions Fixed Version
github.com/opentofu/opentofu
golang/github.com/opentofu/opentofu
Go
< 1.11.10
1.11.10
github.com/opentofu/opentofu
golang/github.com/opentofu/opentofu
Go
≥ 1.12.0-beta1
< 1.12.3
1.12.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq
OpenTofu Source Repository REPOSITORY
https://github.com/opentofu/opentofu/pull/4288
OpenTofu Source Repository REPOSITORY
https://github.com/opentofu/opentofu/pull/4292
OpenTofu Source Repository REPOSITORY
https://github.com/opentofu/opentofu/pull/4293
GitHub Advisory / Wiki ADVISORY
https://github.com/advisories/GHSA-92mm-2pjq-r785
OpenTofu Release RELEASE
https://github.com/hashicorp/go-getter/releases/tag/v1.8.6
OpenTofu Source Repository REPOSITORY
https://github.com/opentofu/opentofu
OpenTofu Release RELEASE
https://github.com/opentofu/opentofu/releases/tag/v1.11.10
OpenTofu Release RELEASE
https://github.com/opentofu/opentofu/releases/tag/v1.12.3

Frequently Asked Questions

What is GHSA-q7j3-v8qv-22vq?
GHSA-q7j3-v8qv-22vq is a security vulnerability in OpenTofu involving Possible arbitrary file read during certain git operations via a maliciously crafted URL under CWE-1395: Dependency on Vulnerable Third-Party Component.
Which OpenTofu versions are affected?
Affected versions include releases prior to 1.11.10, 1.12.3 across affected packages: github.com/opentofu/opentofu.
What version fixes GHSA-q7j3-v8qv-22vq?
Upgrading to 1.11.10, 1.12.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/opentofu/opentofu affected?
Yes, github.com/opentofu/opentofu is affected in releases prior to 1.11.10, 1.12.3. Upgrade your dependency to 1.11.10, 1.12.3 or later.
What is the CVSS score of GHSA-q7j3-v8qv-22vq?
GHSA-q7j3-v8qv-22vq has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
What CWE is associated with GHSA-q7j3-v8qv-22vq?
GHSA-q7j3-v8qv-22vq is classified under CWE-1395: Dependency on Vulnerable Third-Party Component (The product has a dependency on a third-party component that contains one or more known vulnerabilities.).
How can I check Go dependencies for GHSA-q7j3-v8qv-22vq?
Run the dependency tree command: 'inspect dependencies for github.com/opentofu/opentofu'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-q7j3-v8qv-22vq",
  "modified" : "2026-06-19T16:35:10Z",
  "published" : "2026-06-19T16:35:09Z",
  "aliases" : [ ],
  "summary" : "OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL",
  "details" : "### Impact\nPossible data exposure.\n#### Summary\nWhile downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read.\nThis might allow disclosure of confidential information.\n\n#### Details\nOpenTofu relies on [go-getter](https://github.com/hashicorp/go-getter) for downloading packages like providers and modules. While doing so from a maliciously crafted URL, the operator could be affected by confidential information disclosure. \n\nThe go-getter maintainers have recently published [CVE-2026-4660](https://github.com/advisories/GHSA-92mm-2pjq-r785) for this library which indirectly affects OpenTofu's behavior.\n\nTypical use of OpenTofu already requires caution in selection of URLs that are used to download modules and providers.\n\n### Patches\nOpenTofu v1.11.10 and v1.12.3 address these vulnerabilities by upgrading to the [hashicorp/go-getter@v1.8.6](https://github.com/hashicorp/go-getter/releases/tag/v1.8.6) that fixes this vulnerability.\n\nThe OpenTofu v1.10 series is also impacted by these vulnerabilities. However, that series is built with an older version of the library and upgrading it risks breaking the whole v1.10 series. \nFor those using OpenTofu v1.10 releases, we recommend planning an upgrade to OpenTofu v1.11.10 in the near future.\n\n### References\n* [Initial report](https://github.com/opentofu/opentofu/pull/4288)\n* [CVE-2026-4660](https://github.com/advisories/GHSA-92mm-2pjq-r785)\n* [OpenTofu v1.12 patch](https://github.com/opentofu/opentofu/pull/4293)\n* [OpenTofu v1.11 patch](https://github.com/opentofu/opentofu/pull/4292)\n* [Patched v1.12.3 version](https://github.com/opentofu/opentofu/releases/tag/v1.12.3)\n* [Patched v1.11.10 version](https://github.com/opentofu/opentofu/releases/tag/v1.11.10)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/opentofu/opentofu"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.11.10"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/opentofu/opentofu"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.12.0-beta1"
      }, {
        "fixed" : "1.12.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/opentofu/opentofu/pull/4288"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/opentofu/opentofu/pull/4292"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/opentofu/opentofu/pull/4293"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-92mm-2pjq-r785"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/hashicorp/go-getter/releases/tag/v1.8.6"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/opentofu/opentofu"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/opentofu/opentofu/releases/tag/v1.11.10"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/opentofu/opentofu/releases/tag/v1.12.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1395" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-19T16:35:09Z",
    "nvd_published_at" : null
  }
}