Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hr22-p62n-hqd9
Vulnerability ID VCID-hr22-p62n-hqd9
Aliases CVE-2023-25652
Summary Several vulnerabilities have been found in Git, the worst of which could lead to remote code execution.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-25652.json
epss 0.01801 https://api.first.org/data/v1/epss?cve=CVE-2023-25652
epss 0.01801 https://api.first.org/data/v1/epss?cve=CVE-2023-25652
epss 0.01801 https://api.first.org/data/v1/epss?cve=CVE-2023-25652
epss 0.01801 https://api.first.org/data/v1/epss?cve=CVE-2023-25652
epss 0.01801 https://api.first.org/data/v1/epss?cve=CVE-2023-25652
epss 0.01801 https://api.first.org/data/v1/epss?cve=CVE-2023-25652
epss 0.01801 https://api.first.org/data/v1/epss?cve=CVE-2023-25652
epss 0.01801 https://api.first.org/data/v1/epss?cve=CVE-2023-25652
cvssv3.1 7.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902
ssvc Track https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902
cvssv3.1 7.5 https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e
ssvc Track https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e
cvssv3.1 7.5 https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx
ssvc Track https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/
cvssv3.1 7.5 https://security.gentoo.org/glsa/202312-15
ssvc Track https://security.gentoo.org/glsa/202312-15
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2023/04/25/2
ssvc Track http://www.openwall.com/lists/oss-security/2023/04/25/2
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-25652.json
https://api.first.org/data/v1/epss?cve=CVE-2023-25652
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25652
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1034835 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034835
18e2b1cfc80990719275d7b08e6e50f3e8cbc902 https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902
2 http://www.openwall.com/lists/oss-security/2023/04/25/2
2188333 https://bugzilla.redhat.com/show_bug.cgi?id=2188333
668f2d53613ac8fd373926ebe219f2c29112d93e https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e
BSXOGVVBJLYX26IAYX6PJSYQB36BREWH https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/
GHSA-2hvf-7c8p-28fx https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx
GLSA-202312-15 https://security.gentoo.org/glsa/202312-15
msg00018.html https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/
RHSA-2023:3192 https://access.redhat.com/errata/RHSA-2023:3192
RHSA-2023:3243 https://access.redhat.com/errata/RHSA-2023:3243
RHSA-2023:3245 https://access.redhat.com/errata/RHSA-2023:3245
RHSA-2023:3246 https://access.redhat.com/errata/RHSA-2023:3246
RHSA-2023:3247 https://access.redhat.com/errata/RHSA-2023:3247
RHSA-2023:3248 https://access.redhat.com/errata/RHSA-2023:3248
RHSA-2023:3263 https://access.redhat.com/errata/RHSA-2023:3263
RHSA-2023:3280 https://access.redhat.com/errata/RHSA-2023:3280
RHSA-2023:3382 https://access.redhat.com/errata/RHSA-2023:3382
RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/
USN-6050-1 https://usn.ubuntu.com/6050-1/
USN-6050-2 https://usn.ubuntu.com/6050-2/
YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-25652.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://security.gentoo.org/glsa/202312-15
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at https://security.gentoo.org/glsa/202312-15
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at http://www.openwall.com/lists/oss-security/2023/04/25/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-01-05T19:56:20Z/ Found at http://www.openwall.com/lists/oss-security/2023/04/25/2
Exploit Prediction Scoring System (EPSS)
Percentile 0.82742
EPSS Score 0.01801
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:11:49.880030+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202312-15 38.0.0