CVE-2023-4782: Hashicorp Terraform

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.

Affected products

• Hashicorp Terraform: from 1.0.8, before 1.5.7 (fixed in 1.5.7)

Published 2023-09-08. Last modified 2026-06-17.