Git's `git apply` overwriting paths outside the working tree
Priority MEDIUM 41CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 3 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01135 66th percentileScored 2026-11-08
Fix Partial git (git): 2.39.2, 2.38.4, 2.37.6 +7Red Hat: 3 advisoriesRed Hat: 3 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Git | git | 2.39.0 to before 2.39.2; 2.38.0 to before 2.38.4; 2.37.0 to before 2.37.6; 2.36.0 to before 2.36.5; 2.35.0 to before 2.35.7; 2.34.0 to before 2.34.7; 2.33.0 to before 2.33.7; 2.32.0 to before 2.32.6; 2.31.0 to before 2.31.7; before 2.30.8 | 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, 2.30.8 | Patch available | CNA |
- git VendorGit Affected 2.39.0 to before 2.39.2; 2.38.0 to before 2.38.4; 2.37.0 to before 2.37.6; 2.36.0 to before 2.36.5; 2.35.0 to before 2.35.7; 2.34.0 to before 2.34.7; 2.33.0 to before 2.33.7; 2.32.0 to before 2.32.6; 2.31.0 to before 2.31.7; before 2.30.8 Fixed in 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, 2.30.8 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* | before 2.30.8; 2.31.0 to before 2.31.7; 2.32.0 to before 2.32.6; 2.33.0 to before 2.33.7; 2.34.0 to before 2.34.7; 2.35.0 to before 2.35.7; 2.36.0 to before 2.36.5; 2.37.0 to before 2.37.6; 2.38.0 to before 2.38.4; 2.39.0 to before 2.39.2 | Vulnerable | Git-scm |
- cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:* Versions before 2.30.8; 2.31.0 to before 2.31.7; 2.32.0 to before 2.32.6; 2.33.0 to before 2.33.7; 2.34.0 to before 2.34.7; 2.35.0 to before 2.35.7; 2.36.0 to before 2.36.5; 2.37.0 to before 2.37.6; 2.38.0 to before 2.38.4; 2.39.0 to before 2.39.2 Vulnerable ·Git-scm
Remediation
- Fix · CNA git (git) Fixed in 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, 2.30.8
Red Hat 3 advisories
- RHSA-2024:0407 Released 2024-01-25 · Red Hat rating Moderategit security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) git-2.31.8-1.el8_6, git-all-2.31.8-1.el8_6, git-core-2.31.8-1.el8_6 +12
- RHSA-2023:3246 Released 2023-05-22 · Red Hat rating Importantgit security update
- Red Hat Enterprise Linux AppStream (v. 8) git-2.39.3-1.el8_8, git-all-2.39.3-1.el8_8, git-core-2.39.3-1.el8_8 +12
- RHSA-2023:3245 Released 2023-05-22 · Red Hat rating Importantgit security update
- Red Hat Enterprise Linux AppStream (v. 9) git-2.39.3-1.el9_2, git-all-2.39.3-1.el9_2, git-core-2.39.3-1.el9_2 +12
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:3246 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:3245 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:0407 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-23946
- 2026-10-08 CISA SSVC decision points changed
- 2026-10-09 Priority changed: LOW → MEDIUM
References
More Git vulnerabilities
- TI-2025-30709 Git allows arbitrary code execution through broken config quoting KEVCVSS 3.1HIGH 8.1
- TI-2022-07580 gitattributes parsing integer overflow in git CVSS 3.1CRITICAL 9.8
- TI-2022-20244 Integer overflow in `git archive`, `git log --format` leading to RCE in git CVSS 3.1CRITICAL 9.8
- TI-2021-04400 malicious repositories can execute remote code while cloning CVSS 3.1HIGH 8.0
- TI-2024-21101 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVSS 3.1CRITICAL 9.1
- TI-2023-10933 "git apply --reject" partially-controlled arbitrary file write CVSS 3.1HIGH 7.5
Sources
- CVE-2023-23946 · CVE Program
- CVE-2023-23946 · NVD
- FIRST EPSS
- CVE-2023-23946 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences