CVE-2023-4782

Name of the Vulnerable Software and Affected Versions Terraform versions 1.0.8 through 1.5.6

Description The issue is related to arbitrary file write during the init operation when run on maliciously crafted Terraform configuration. This is due to incorrect restriction of the directory path name with limited access. The exploitation of this issue may allow an attacker to upload arbitrary files.

Recommendations For Terraform versions 1.0.8 through 1.5.6, update to Terraform 1.5.7 to resolve the issue. As a temporary workaround, consider restricting the use of the init operation on untrusted configurations until the update is applied.