CVE-2023-49569

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

Description

A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications are only affected if they are using the ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using "Plain" versions of Open and Clone funcs (e.g. PlainClone). Applications using BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue. This is a go-git implementation issue and does not affect the upstream git cli.

Remediation

Solution:

  • An update to version 5.11 fixes the issue

Category

9.8
CVSS
Severity: Critical
CVSS 3.1 •
EPSS 3.01% Top 15%
Vendor Advisory github.com
Affected: go-git go-git
Published at:
Updated at:

References

Link Tags
https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88 vendor advisory

Frequently Asked Questions

What is the severity of CVE-2023-49569?
CVE-2023-49569 has been scored as a critical severity vulnerability.
How to fix CVE-2023-49569?
To fix CVE-2023-49569: An update to version 5.11 fixes the issue
Is CVE-2023-49569 being actively exploited in the wild?
It is possible that CVE-2023-49569 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~3% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-49569?
CVE-2023-49569 affects go-git go-git.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.