CVSS 3.0
5.9 mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2019-3902
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-59, CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- mercurial:mercurial
- redhat:enterprise_linux
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mq66-vcfc-8246 | PyPI | mercurial | <4.9 | 4.9 |
| PYSEC-2019-188 | PyPI | mercurial | <4.9 | 4.9 |