CVE-2026-74796
Fixed upstream EPSS <1%CVSS 6.1
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.
Products: opentofu
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/opentofu/opentofu | 1.11.7 |
| Go | github.com/opentofu/opentofu | 1.10.10 |