GitHub Advisoryadvisory · Go
GHSA-5mqx-rpxv-mvxj HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration
HIGH
Official page ↗
- Aliases
- CVE-2024-6717
- Ecosystem
- Go
- Packages
- github.com/hashicorp/nomad
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- Weaknesses
- CWE-610
- Reviewed
- 2026-01-05
Affected packages
• Go github.com/hashicorp/nomad: < 1.8.2 → fixed in 1.8.2
Description
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.
Related
Alias · CVE (1)
- CVE-2024-6717 HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the… vulnerability
Weakness · CWE (1)
- CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-6717 advisory
- https://github.com/hashicorp/nomad/commit/ef6cdec8847e0698d386d1fd3761743df758ef99 web
- https://discuss.hashicorp.com/t/hcsec-2024-15-nomad-vulnerable-to-allocation-directory-path-escape-through-archive-unpacking/68781 web
- https://github.com/hashicorp/nomad package
- https://github.com/hashicorp/nomad/releases/tag/v1.8.2 web