CVE-2026-113408 PUBLISHED

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Git

Assigner: GitLab
Reserved: 20.10.2026 Published: 12.11.2026 Updated: 12.11.2026

Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS Score: 3.3

Product Status

Vendor Git
Product Git
Versions Default: unknown
  • Version 2.50.1 is affected
  • Version 2.51.2 is affected
  • Version 2.52.0 is affected
  • Version 2.53.0 is affected
  • Version 2.54.0 is affected
  • Version 2.55.0 is affected
  • Version 2.56.0 is affected

Solutions

Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above.

Credits

  • ehdgks0627, un3xploitable finder

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE