Arbitrary file write via cache symlink

Path traversal in OpenTofu before 1.10.10 and 1.11.0 through 1.11.6 allows attackers to write files via a malicious provider-cache symlink. During provider installation, tofu init treats a preexisting cache entry as a writable package directory and follows its symlink target instead of rejecting or replacing a mismatched link before extracting provider contents. Exploitation requires control of a trusted working directory, or of the directory named by TF_DATA_DIR, and an operator to run tofu init there; the result is arbitrary filesystem writes with the OpenTofu process's permissions.