Terraform bundles the go-slug library, which builds the
archive uploaded to HCP Terraform or Terraform Enterprise
when a run is started. In go-slug before v0.18.3, matching
of .terraformignore rules does not consistently treat
canonically equivalent Unicode filenames as the same path.
On filesystems that normalize filenames, a file whose
displayed name appears to match an exclusion rule can still
end up in the generated upload bundle, so local files an
operator intended to keep out of remote runs may be
transmitted.
Exploitation requires local control over the working
directory contents, use of .terraformignore, and filenames
and ignore patterns that differ only by Unicode
normalization form. Setups that do not use
.terraformignore, use ASCII-only filenames and patterns, or
run on filesystems that do not perform this normalization
are not affected.