{"cve":"CVE-2023-49569","nvd":{"published":"2024-01-12T11:15:13.250","modified":"2026-06-17T06:36:10.567","status":"Modified","description":"A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved.\n\nApplications are only affected if they are using the  ChrootOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#ChrootOS , which is the default when using \"Plain\" versions of Open and Clone funcs (e.g. PlainClone). Applications using  BoundOS https://pkg.go.dev/github.com/go-git/go-billy/v5/osfs#BoundOS  or in-memory filesystems are not affected by this issue.\nThis is a go-git implementation issue and does not affect the upstream git cli.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-22"],"references":["https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88","https://github.com/go-git/go-git/security/advisories/GHSA-449p-3h89-pw88"],"products":["go-git_project:go-git"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2023-49569","score":0.0151,"percentile":0.74449,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-449p-3h89-pw88","url":"https://osv.dev/vulnerability/GHSA-449p-3h89-pw88","summary":"Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients","modified":"2026-09-10T03:50:04.744502851Z","packages":[{"ecosystem":"Go","name":"github.com/go-git/go-git/v5","purl":"pkg:golang/github.com/go-git/go-git/v5","ranges":[">=5.0.0 <5.11.0"],"fixed":["5.11.0"]},{"ecosystem":"Go","name":"gopkg.in/src-d/go-git.v4","purl":"pkg:golang/gopkg.in/src-d/go-git.v4","ranges":[">=4.0.0 <=4.13.1"],"fixed":[]}]},{"id":"GO-2024-2456","url":"https://osv.dev/vulnerability/GO-2024-2456","summary":"Path traversal and RCE in github.com/go-git/go-git/v5 and gopkg.in/src-d/go-git.v4","modified":"2026-02-04T04:20:40.051740Z","packages":[{"ecosystem":"Go","name":"gopkg.in/src-d/go-git.v4","purl":"pkg:golang/gopkg.in/src-d/go-git.v4","ranges":[">=4.7.1"],"fixed":[]},{"ecosystem":"Go","name":"github.com/go-git/go-git/v5","purl":"pkg:golang/github.com/go-git/go-git/v5","ranges":[">=5.0.0 <5.11.0"],"fixed":["5.11.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}