GitHacker

GitHacker 一个多线程的 .git 文件夹利用工具。即使禁用了目录列表（DirectoryListings），也能通过暴力破解已知引用来完整重建目标仓库——包括源代码、提交历史、分支、暂存区、远程仓库和标签。 配套研究网站位于 https://githacker.pages.dev ，发布了： 一份可重现的 基准测试 ，针对其他六个掠夺工具（GitTools、dvcs-ripper、GitHack、git-dumper、dumpall、rbozburun/git-hacker）在五种 Web 服务器场景下的表现。 一套对抗性的 安全测试套件 ，针对恶意构造的 .git/...

CVE-2026-50024

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

CVE-2026-50024 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

EUVD-2026-78777

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

CVE-2026-50024 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

CVE-2026-50024 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

CVE-2026-50024

GitHacker (a tool that restores Git repositories from exposed .git directories) is vulnerable to path traversal in versions 1.1.7 and earlier . The function add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated segments onto temp_dst/.git/logs/, while add...

CVE-2026-50024: Improper Limitation of a Pathname to a Restricted Directory

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...

PYSEC-2026-3835 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

SummaryGitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns a...

CVE-2026-50024

creationtimestamp| type| source ---|---|--- 2026-09-09 20:35:05+00:00| published-proof-of-concept| https://github.com/WangYihang/GitHacker/security/advisories/GHSA-hr3m-4qwq-3mgc...

Relative Path Traversal

Overview githacker is an A multiple threads tool to download the .git folder and rebuild git repository locally. Affected versions of this package are vulnerable to Relative Path Traversal via the addheadfiletasks function. An attacker can access arbitrary local files and exfiltrate fragments of...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

GHSA-HR3M-4QWQ-3MGC GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

PT-2026-89202

Name of the Vulnerable Software and Affected Versions GitHacker versions prior to 1.1.8 Description GitHacker fails to validate path segments parsed from an attacker-controlled .git/HEAD file before joining them to the output directory. A malicious server can coerce the tool into reading arbitrar...