What is CVE-2023-25652?

CVE-2023-25652 is a high-severity vulnerability in Git, classified under Path Traversal. CVSS score: 7.5/10. Published 2023-04-25.

How severe is CVE-2023-25652?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2023-25652 known to be exploited?

9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Git

CVE-2023-25652

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.522 (98.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Git — versions < 2.30.9, >= 2.31.0, < 2.31.8, >= 2.32.0, < 2.32.7

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2023-25652?: CVE-2023-25652 is a high-severity vulnerability in Git, classified under Path Traversal. CVSS score: 7.5/10. Published 2023-04-25.
How severe is CVE-2023-25652?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2023-25652 known to be exploited?: 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.