CVE-2026-113408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-113408", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-10-20T06:03:58.616Z", "datePublished": "2026-11-12T07:09:19.100Z", "dateUpdated": "2026-11-12T07:09:19.100Z"}, "containers": {"cna": {"title": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Git", "descriptions": [{"lang": "en", "value": "Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}], "affected": [{"vendor": "Git", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "cpes": ["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"], "versions": [{"version": "2.50.1", "status": "affected"}, {"version": "2.51.2", "status": "affected"}, {"version": "2.52.0", "status": "affected"}, {"version": "2.53.0", "status": "affected"}, {"version": "2.54.0", "status": "affected"}, {"version": "2.55.0", "status": "affected"}, {"version": "2.56.0", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/git/-/work_items/809"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above."}], "credits": [{"lang": "en", "value": "ehdgks0627, un3xploitable", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-11-12T07:09:19.100Z"}}}}

{}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "Git", "repo": "https://gitlab.com/git-scm/git", "vendor": "Git", "versions": [{"status": "affected", "version": "2.50.1"}, {"status": "affected", "version": "2.51.2"}, {"status": "affected", "version": "2.52.0"}, {"status": "affected", "version": "2.53.0"}, {"status": "affected", "version": "2.54.0"}, {"status": "affected", "version": "2.55.0"}, {"status": "affected", "version": "2.56.0"}]}], "source": "cve@gitlab.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}], "id": "CVE-2026-113408", "lastModified": "2026-11-12T19:05:35.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-11-12T07:16:45.597", "references": [{"source": "cve@gitlab.com", "url": "https://gitlab.com/gitlab-org/git/-/work_items/809"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{"bugzilla": {"description": "git: git: Unintended file writes via malformed unborn HEAD advertisement", "id": "2567369", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567369"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Git. A malicious server can advertise a malformed unborn HEAD reference during repository operations, causing unintended file writes on the client system during subsequent reference updates. This vulnerability may compromise data integrity by modifying unexpected files or corrupting repository data."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-113408", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "git", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "git", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "rubygem-git", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-10T18:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-113408\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-113408"], "statement": "This vulnerability is rated as Moderate severity because successful exploitation requires connecting to a malicious or compromised remote repository. In typical Red Hat deployments, Git client interactions are restricted to trusted upstream repositories and internal source control servers. While an attacker-controlled remote server could manipulate unborn branch advertisements to trigger unintended client-side file writes with the default files backend, this issue does not permit remote code execution or privilege escalation.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.50.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.51.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.52.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.53.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.54.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.55.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.56.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Git", "source": "cna", "vendor": "Git"}, "product": "git", "vendor": "git"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "git", "vendor": "git-scm"}], "created": "2026-11-11T18:45:21.795466+00:00", "updated": "2026-11-13T04:30:09.415351+00:00", "vendors": ["git", "git$PRODUCT$git", "git-scm", "git-scm$PRODUCT$git"]}