GitDump

GitDump GitDump はディレクトリトラバーサルが無効な場合に .git からソースコードをダンプします 必要条件 Python3 テスト済み Windows Kali Linux 機能 ディレクトリトラバーサルが無効な場合に、website/.git ディレクトリからソースコードをダンプします。 動作原理 一般的なファイル .git/index, .git/HEAD, .git/ORIGHEAD など をすべて取得します。 .git/packed-refs や .git/index などを解析して、できるだけ多くのオブジェクト sha1 を見つけます。 idx ファイルと...

GitPython: GitPython: Remote Code Execution via Git directory impersonation

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

GitPython: GitPython: Remote Code Execution via Git directory impersonation

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

GitPython: GitPython: Remote Code Execution via Git directory impersonation

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

git-dump

git-dump Este script es una herramienta para descargar recursivamente el contenido del directorio '.git' de un sitio web. Utilizando Python y librerías como 'requests' y 'BeautifulSoup', este script examina la estructura de directorios, descarga archivos e identifica los hashes SHA-1 dentro de lo...

GitPython: GitPython: Remote Code Execution via Git directory impersonation

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Summary Repo.init decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and...

EUVD-2026-74843

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution...

cve-2024-32002-poc-aw

CVE-2024-32002 PRC AW 一个针对 CVE-2024-32002 的 POC，演示了对 .git 目录的任意写入。 请参阅相关的子模块仓库：cve-2024-32002-submodule-aw 本仓库包含的内容 一个指向 .git 目录的符号链接，其名称是任意的。 一个定义恶意子模块的 .gitmodules 文件。 如何重新创建此仓库 此仓库是在 Linux（具体来说是 WSL2）上创建的。这一点很重要，恶意仓库只能在大小写敏感的文件系统上创建。 1. 创建一个符号链接，全部使用小写字符 ln -s .git submodule 注： 符号链接应指向 .git...

cve-2024-32002-submodule-aw

CVE-2024-32002 子模块 AW 一个用于演示 CVE-2024-32002 的子模块，演示向 .git 的任意写入。 有关使用此仓库的可运行 POC，请参阅 cve-2024-32002-poc-aw。 此仓库包含的内容 只不过是一个随机文件，以便我们在克隆父 POC 仓库时能检测到它 该文件名为 Problems，因为如果我们在 .git 中看到这个文件，就意味着出问题了...

GitPython: GitPython: Remote Code Execution via Git directory impersonation

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

Critical: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

GitPython: GitPython: Remote Code Execution via Git directory impersonation

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

Critical: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.6 Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Astra Linux – Vulnerability in Git

Git is a version control system. Before versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories containing submodules could be exploited through a bug in Git. This bug allowed a script to be written into the .git/ directory instead of the submodule’s worktree. This enabl...

SUSE CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-87817

A flaw was found in GitPython. This vulnerability allows a remote attacker to execute arbitrary code. By failing to properly validate the git directory location, GitPython allows attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can th...

Duplicate Advisory: Repository content can impersonate the git directory, leading to arbitrary code execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-239g-whfq-7xj9. This link is maintained to preserve external references. Original Description GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the...

DEBIAN-CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

UBUNTU-CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...