CVE-2023-4782

Terraform Allows Arbitrary File Write During Init Operation

6.3 MediumFix available

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: None

Exploit likelihood

0.27%Up 0.2 points since Sep 9, 2023

What each source reports

CVE List Score used 6.3

Terraform Allows Arbitrary File Write During Init Operation

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Record: CVE-2023-4782
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2023-2517 6.3

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Record: EUVD-2023-2517
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-h626-pv66-hhm7 6.3

Terraform allows arbitrary file write during the `init` operation

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Record: GHSA-h626-pv66-hhm7
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

NVD 6.3

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Record: CVE-2023-4782
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSVAZL-29705 7.8

CVE-2023-4782 affecting package terraform for versions less than 1.3.2-19

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Record: AZL-29705
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 6.3

Terraform Allows Arbitrary File Write During Init Operation

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Record: CVE-2023-4782
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSVGHSA-h626-pv66-hhm7 6.3

Terraform allows arbitrary file write during the `init` operation

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the init operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Record: GHSA-h626-pv66-hhm7
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSVGO-2023-2055 No score

Terraform allows arbitrary file write during the `init` operation in github.com/hashicorp/terraform

Terraform allows arbitrary file write during the init operation in github.com/hashicorp/terraform

Record: GO-2023-2055
Updated: 2026-11-02

Affected products

hashicorp terraform

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/hashicorp/terraform` Go	1.0.8 up to 1.5.7	1.5.7
`terraform` Azure Linux:2	before 1.3.2-19	1.3.2-19

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-4782 is a medium vulnerability (CVSS 6.3) in Hashicorp Terraform, published September 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in github.com/hashicorp/terraform 1.5.7.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

Affected packages

History

In short

References