CVE-2023-49569

    Dashboard / Vulnerabilities / CVE-2023-49569

    CVE-2023-49569

    Published: 12 Jan 2024Last Modified: 12 Aug 2026

    Summary: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

    Details: A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49569.json, https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88, https://nvd.nist.gov/vuln/detail/CVE-2023-49569

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca
    Fixed -5d08d3bd94c65a3b6c25c6fba6907d12b0dac4ca

    Affected versions

    5.11.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-49569 | CVE-DB