CVE-2026-27735Medium▾ Sunlitmcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
In mcp-server-git versions prior to 2026.1.14, the git_add tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's repo.index.add(, which did not enforce working-tree boundary checks for relative paths. As a result, relative paths containing ../ sequences that resolved outside the repository were accepted and staged into the Git index, potentially allowing sensitive files to be exfiltrated via subsequent commit and push operations. The fix in PR #3164 switches to repo.git.add(), which delegates to the Git CLI and properly rejects out-of-tree paths. Users are advised to upgrade to 2026.1.14 or newer to remediate this issue.
mcp-server-git thanks https://hackerone.com/0dd-g for reporting and contributing the fix.
mcp-server-git < 2026.1.14Upgrade to a patched release:
mcp-server-git 2026.1.14Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68145Mediummcp-server-git has missing path validation when using --repository flag
CVE-2025-68144Mediummcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
CVE-2025-68143Mediummcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations