Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

CVE-2020-27955

🗓️ 05 Nov 2020 14:57:36Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 257 Views🌐 WEB

Git LFS 2.12.0 CVE-2020-27955 RC

Related
Detection
Refs
Paths
Social
ReporterTitlePublishedViews
Family
githubexploit
GithubExploit		Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage
25 May 202115:26
–githubexploit
githubexploit
GithubExploit		Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage
4 Nov 202016:43
–githubexploit
githubexploit
GithubExploit		Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage
30 Apr 202114:25
–githubexploit
githubexploit
GithubExploit		Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage
30 Apr 202109:38
–githubexploit
githubexploit
GithubExploit		Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage
13 May 202110:30
–githubexploit
githubexploit
GithubExploit		Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage
24 Nov 202002:40
–githubexploit
githubexploit
GithubExploit		Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage
2 Aug 202112:32
–githubexploit
githubexploit
GithubExploit		Exploit for Uncontrolled Search Path Element in Git_Large_File_Storage_Project Git_Large_File_Storage
3 Nov 202017:14
–githubexploit
zdt
zdt		git-lfs Remote Code Execution Exploit
8 Nov 202000:00
–zdt
zdt
zdt		Git git-lfs Remote Code Execution Exploit
17 Sep 202100:00
–zdt
Rows per page
ParameterPositionPathDescriptionCWE
git-upload-packpath/<repo>.git/git-upload-packGit LFS/Smart HTTP upload-pack path used by vulnerable Git client implementations (CVE-2020-27955)CWE-427
info/refspath/<repo>.git/git-upload-packGit LFS/Smart HTTP upload-pack path used by vulnerable Git client implementations (CVE-2020-27955)CWE-427
ref-discoverypath/<repo>.git/git-upload-packGit LFS/Smart HTTP upload-pack path used by vulnerable Git client implementations (CVE-2020-27955)CWE-427
upload-packpath/<repo>.git/git-upload-packGit LFS/Smart HTTP upload-pack path used by vulnerable Git client implementations (CVE-2020-27955)CWE-427
operationrequest body/<repo>.git/lfs/objects/batchGit LFS batch endpoint used to deliver LFS objects, exploited by the vulnerability to achieve remote code executionCWE-427
objectsrequest body/<repo>.git/lfs/objects/batchGit LFS batch endpoint used to deliver LFS objects, exploited by the vulnerability to achieve remote code executionCWE-427
transfersrequest body/<repo>.git/lfs/objects/batchGit LFS batch endpoint used to deliver LFS objects, exploited by the vulnerability to achieve remote code executionCWE-427
reference-objectsrequest body/<repo>.git/lfs/objects/batchGit LFS batch endpoint used to deliver LFS objects, exploited by the vulnerability to achieve remote code executionCWE-427

報告してたGoの脆弱性が修正されてました。 CVE-2020-27955の概要読んで絶対Go自体も影響受けるなと思ってコード読んでる時に見つけたやつです。

CVE-2020-27955 Git Large File Storage Git LFS (git-lfs) Remote Code Execution (RCE). Git LFS (git-lfs)in versions <= 2.12 has a vulnerability that allows remote attackers to execute arbitrary code on the victim&#0... https://t.co/fNgqw1EIo6?amp=1

It is the first time for me to know a protection/signature/rule for the vulnerability CVE-2020-27955. #Spehnzcn7qw3ze

Critical Git git-lfs vuln RCE exploit CVE-2020-27955 many git clients affected

なるほどなぁ https://t.co/mUAAmRtMzD?amp=1 / “RyotaK on Twitter: "報告してたGoの脆弱性が修正されてました。 CVE-2020-27955の概要読んで絶対Go自体も影響受けるなと思ってコード読んでる時に見つけたやつです。 /golang/status/1351673649850421249"” https://t.co/VV3pOMSWBE?amp=1

(Same from about 2 hours ago.) I think that the third retweeted(20 times) tweet that contains CVE ID between Jan 19 2021 17:01 UTC and Jan 20 2021 17:00 UTC is: /ryotkak/status/1351698751098818560 It has CVE-2020-27955. #l24_pehnzcn7qw3ze

(Same from about 4 hours ago.) I think that the third retweeted(24 times) tweet that contains CVE ID between Jan 19 2021 19:01 UTC and Jan 20 2021 19:00 UTC is: /ryotkak/status/1351698751098818560 It has CVE-2020-27955. #l24_pehnzcn7qw3ze

buaqbot

CVE-2020-27955 - Git 大文件存储/Git LFS (git-lfs) - 远程代码执行 (RCE) https://t.co/kTxREmpMWZ

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 03:09Current
8.7High risk
Vulners AI Score8.7
CVSS 3.19.8
CVSS 210
EPSS0.82591
CWE-427
gitlfs2.12.0cve-2020-27955rcenvd
257