{"id":"EUVD-2026-59961","enisaUuid":"0be53370-bbb1-3d8f-b75e-9d3dc2acd97a","description":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.","datePublished":"Aug 16, 2026, 1:14:18 PM","dateUpdated":"Oct 8, 2026, 3:24:46 PM","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm\nhttps://www.vulncheck.com/advisories/opentofu-before-symlink-following-path-traversal\n","aliases":"CVE-2026-74796\nGHSA-69hj-5jh6-6q99\n","assigner":"VulnCheck","epss":0.34,"enisaIdProduct":[{"id":"ae03d6b6-ed7b-3067-8a90-b7c013c3429c","product":{"name":"OpenTofu","vendor":{"name":"open source"}},"product_version":"0 \u003c1.11.7"}],"enisaIdVendor":[{"id":"4cb2813d-37dc-3aa5-bc52-311e0e32d8ee","vendor":{"name":"opentofu"}}],"enisaIdVulnerability":[{"id":"355fbe14-5670-3517-8e8c-698de4a145c2","vulnerability":{"id":"GHSA-69hj-5jh6-6q99","description":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.","datePublished":"Aug 16, 2026, 3:30:27 PM","dateUpdated":"Aug 16, 2026, 3:30:27 PM","baseScore":0.0,"references":"https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74796\nhttps://www.vulncheck.com/advisories/opentofu-before-symlink-following-path-traversal\n","enisa_id":"EUVD-2026-59961\n","aliases":"GHSA-69hj-5jh6-6q99\nCVE-2026-74796\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:59:06 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"60d8c05e-88d7-39b3-a82b-236e4b8797bb","vulnerability":{"id":"CVE-2026-74796","description":"OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.","datePublished":"Aug 16, 2026, 1:14:18 PM","dateUpdated":"Oct 8, 2026, 3:24:46 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","references":"https://github.com/opentofu/opentofu/security/advisories/GHSA-wcmj-x466-56mm\nhttps://www.vulncheck.com/advisories/opentofu-before-symlink-following-path-traversal\n","enisa_id":"EUVD-2026-59961\n","assigner":"VulnCheck","epss":0.34,"dataProcessed":"Oct 28, 2026, 7:13:58 AM","vulnerabilityProduct":[{"id":"187fc87d-f7de-3f00-8eae-b43480b962ce","product":{"name":"OpenTofu","vendor":{"name":"open source"}},"product_version":"0 \u003c1.11.7"}],"vulnerabilityVendor":[{"id":"95fee278-f351-3ea7-8f1d-da9c3cd5862f","vendor":{"name":"opentofu"}}]}}],"enisaIdAdvisory":[]}