Privilege escalation in Atlassian Sourcetree
CVE-2025-22165
This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives . You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives . This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE).
Vulnerability class: Privilege Escalation
EPSS: 0.001 (3.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Atlassian Sourcetree
- Atlassian Sourcetree For Mac — versions All versions from 4.2.8 to 4.2.11 inclusive, All versions from 4.2.12
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@atlassian.com (Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-22165?
- CVE-2025-22165 is a high-severity vulnerability in Atlassian Sourcetree, classified under Improper Privilege Management. CVSS score: 7.3/10. Published 2025-07-24.
- How severe is CVE-2025-22165?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2025-22165 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.