What is CVE-2025-22165?

CVE-2025-22165 is a high-severity vulnerability in Atlassian Sourcetree, classified under Improper Privilege Management. CVSS score: 7.3/10. Published 2025-07-24.

How severe is CVE-2025-22165?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2025-22165 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Privilege escalation in Atlassian Sourcetree

CVE-2025-22165

This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) vulnerability, with a CVSS Score of 5.9, allows a locally authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac users upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions. See the release notes https://www.sourcetreeapp.com/download-archives . You can download the latest version of Sourcetree for Mac from the download center https://www.sourcetreeapp.com/download-archives . This vulnerability was found through the Atlassian Bug Bounty Program by Karol Mazurek (AFINE).

Vulnerability class: Privilege Escalation

Published 2025-07-24 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.001 (3.5th percentile), scored 2026-10-22.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 4th percentile — 3.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000

Affected products

Atlassian Sourcetree
Atlassian Sourcetree For Mac — versions All versions from 4.2.8 to 4.2.11 inclusive, All versions from 4.2.12

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

Public proof-of-concept exploits

References

jira.atlassian.com/browse/SRCTREE-8217 (Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2025-22165?: CVE-2025-22165 is a high-severity vulnerability in Atlassian Sourcetree, classified under Improper Privilege Management. CVSS score: 7.3/10. Published 2025-07-24.
How severe is CVE-2025-22165?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2025-22165 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.