CVE-2023-23946Medium· 6.2▾ TwilightPoC available

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score46/ 100 · Moderate

impact 34.1 · likelihood 0.2 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Feb 14, 2023

Updated

Oct 8, 2026

CVSS

6.2

Vendor

git-scm

Product

git

CWE

CWE-22, CWE-22

Depth score

46 · Moderate

EPSS

1.1% · p66

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-08

GitHub PoCs

2 public repositories

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 1333 days

Feb 14, 2023Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
1.1%
Oct 8, 2026Public exploit observed
2 GitHub repos (last check)

git-scm CWE-22 CWE-22 #nvd #exploit-available

Affected

git < 2.30.8
git >= 2.31.0, < 2.31.7
git >= 2.32.0, < 2.32.6
git >= 2.33.0, < 2.33.7
git >= 2.34.0, < 2.34.7
git >= 2.35.0, < 2.35.7
git >= 2.36.0, < 2.36.5
git >= 2.37.0, < 2.37.6
git >= 2.38.0, < 2.38.4
git >= 2.39.0, < 2.39.2

Patched in

git 2.39.2

Full technical detail▾

Overview

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to git apply, a path outside the working tree can be overwritten as the user who is running git apply. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use git apply --stat to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.

Affected

git < 2.30.8
git >= 2.31.0, < 2.31.7
git >= 2.32.0, < 2.32.6
git >= 2.33.0, < 2.33.7
git >= 2.34.0, < 2.34.7
git >= 2.35.0, < 2.35.7
git >= 2.36.0, < 2.36.5
git >= 2.37.0, < 2.37.6
git >= 2.38.0, < 2.38.4
git >= 2.39.0, < 2.39.2

Remediation

Upgrade past the affected range:

git 2.39.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available

← Back to feed

CVE-2023-23946Medium· 6.2▾ TwilightPoC available

Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score46/ 100 · Moderate

impact 34.1 · likelihood 0.2 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Feb 14, 2023

Updated

Oct 8, 2026

CVSS

6.2

Vendor

git-scm

Product

git

CWE

CWE-22, CWE-22

Depth score

46 · Moderate

EPSS

1.1% · p66

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-08

GitHub PoCs

2 public repositories

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 1333 days

Feb 14, 2023Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
1.1%
Oct 8, 2026Public exploit observed
2 GitHub repos (last check)

git-scm CWE-22 CWE-22 #nvd #exploit-available

Affected

git < 2.30.8
git >= 2.31.0, < 2.31.7
git >= 2.32.0, < 2.32.6
git >= 2.33.0, < 2.33.7
git >= 2.34.0, < 2.34.7
git >= 2.35.0, < 2.35.7
git >= 2.36.0, < 2.36.5
git >= 2.37.0, < 2.37.6
git >= 2.38.0, < 2.38.4
git >= 2.39.0, < 2.39.2

Patched in

git 2.39.2

Full technical detail▾

Overview

Affected

git < 2.30.8
git >= 2.31.0, < 2.31.7
git >= 2.32.0, < 2.32.6
git >= 2.33.0, < 2.33.7
git >= 2.34.0, < 2.34.7
git >= 2.35.0, < 2.35.7
git >= 2.36.0, < 2.36.5
git >= 2.37.0, < 2.37.6
git >= 2.38.0, < 2.38.4
git >= 2.39.0, < 2.39.2

Remediation

Upgrade past the affected range:

git 2.39.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available