High severity · published Feb 14, 2023
CVE-2023-23946
Git's `git apply` overwriting paths outside the working tree
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
git · git
>= 2.39.0, < 2.39.2; >= 2.38.0, < 2.38.4; >= 2.37.0, < 2.37.6; >= 2.36.0, < 2.36.5; >= 2.35.0, < 2.35.7; >= 2.34.0, < 2.34.7; +4 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23946
x_refsource_CONFIRM
https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh
x_refsource_MISC
https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd
security.gentoo.org
https://security.gentoo.org/glsa/202312-15
More from git
8.0
CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
9.8
CVE-2022-25648
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection
9.0
CVE-2024-32002
Git is a revision control system
8.8
CVE-2024-52005
Git is a source code management tool
8.8
CVE-2022-39260
Git vulnerable to Remote Code Execution via Heap overflow in `git shell`