CVE-2023-23946
MediumCVSS 6.2Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
Git is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding crafted input to `git apply`, a path outside the working tree can be overwritten as the user running `git apply`.
Risk Assessment
An attacker can overwrite arbitrary files outside the repository, potentially modifying system configuration or executing code in the user's context.
Recommendation
Update Git to a version containing the fix. As a workaround, use `git apply --stat` to inspect a patch before applying and avoid patches that create a symbolic link and then create a file beyond it.
Other vulnerabilities in Git
See all- CVE-2017-14867High
Git versions before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 use unsafe Perl scripts to support subcommands, allowing attackers to execute arbitrary OS commands via shell metacharacters in a module name.
- CVE-2025-48385High
Git is a fast, scalable, distributed revision control system. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload.
- CVE-2024-50349Medium
When Git asks for credentials via a terminal prompt (without using a credential helper), it prints the host name for which the credentials are requested. This may lead to unintended disclosure of the host name.
- CVE-2024-52006High
Git defines a line-based protocol used to exchange information between Git and Git credential helpers. Some ecosystems (most likely those using this protocol) may be vulnerable to attacks related to this protocol.
- CVE-2015-7545Critical
In Git versions before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, there is a vulnerability that does not properly restrict allowed protocols in remote helper programs. This may allow remote attackers to execute arbitrary code via a URL in a .gitmodules file or other unknown sources in a submodule.
- CVE-2016-2324Critical
Integer overflow in Git before version 2.7.4 allows remote attackers to execute arbitrary code via (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
- CVE-2016-2315Critical
In git versions before 2.7.4, there is a bug in revision.c that uses an incorrect integer data type. This allows remote attackers to execute arbitrary code via (1) long filenames or (2) many nested trees, leading to a heap-based buffer overflow.
- CVE-2026-93326Medium
A build step for a Git source, crafted in a specific way, can bypass some policy validation rules. A malicious build definition can make the repository look like it is coming from a different remote URL than it really is when Git clone is happening. If policy is doing more stricter validation, for example based on commit SHA, commit data, or signatures, then all these validations still apply correctly.
- CVE-2025-69160High
Gita versions up to 1.11 are vulnerable to unauthenticated local file inclusion.
- CVE-2023-22490Medium
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.
Original NVD description (English source)
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS