TI-2008-02816 Aliases CVE-2008-2942 GHSA-v2gw-x5jf-pgwv

Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted…

LOW 34CWE-22Published 2008-06-30 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: —
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.

Why it matters now

EPSS 0.01901 79th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mercurial (PyPI): 1.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	mercurial (PyPI)	before 1.0.2	1.0.2	Patch available	GHSA-v2gw-x5jf-pgwv

— Vendor— Affected all versions Fixed in — No fix listed CNA
mercurial (PyPI) Vendor— Affected before 1.0.2 Fixed in 1.0.2 Patch available GHSA-v2gw-x5jf-pgwv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mercurial:mercurial:1.0.1:::::::*	1.0.1	Vulnerable	Mercurial

cpe:2.3:a:mercurial:mercurial:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Mercurial

Remediation

Fix · GHSA-v2gw-x5jf-pgwv mercurial (PyPI) Fixed in 1.0.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2008-2942
2026-10-03 Alias added: GHSA-v2gw-x5jf-pgwv

References

Exploit 1

http://www.selenic.com/hg/rev/87c704ac92d4

Advisory 3

Other 5

TI-2014-07619 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… CVSS 3.1CRITICAL 9.8
TI-2017-06870 In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch… CVSS 3.1HIGH 8.8
TI-2017-14453 Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks. CVSS 3.0CRITICAL 9.8
TI-2017-12752 In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause… CVSS 3.0CRITICAL 9.8
TI-2018-09592 mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002. CVSS 3.0CRITICAL 9.8
TI-2016-03079 The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute… CVSS 3.1HIGH 8.8

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences