CVE-2025-48384-submodule

CVE-2025-48384 서브모듈 이 서브모듈은 데모용 악성 post-checkout 훅을 포함하고 있습니다...

CVE-2025-48384

CVE-2025-48384 PoC 이 저장소는 서브모듈 경로에 캐리지 리턴 문자가 포함된 Git 취약점인 CVE-2025-48384를 시연합니다. 경고 이는 교육 목적으로만 사용됩니다. 격리된 환경에서 사용하세요...

CVE-2024-32002-hook

CVE-2024-32002-hook CVE-2024-32002-hook...

docker-cve-2022-39253-poc

docker 호스트 파일 읽기 cve-2022-39253 활용 poc PoC 환경 재현 $ docker run --name=cve-2022-39253 -ti -d ssst0n3/dockerarchive:gitcve-2022-39253 $ docker attach --detach-keys ctrl-x cve-2022-39253 use ctrl-x to exit container's terminal wait minutes for environment starting ... ... Ubuntu 22.04 LTS ubuntu ttyS...

GitPython submodule update path traversal can write outside the repository

Affected: GitPython 3.1.61 latest release and main — git/objects/submodule/base.py. git diff 3.1.61 origin/main -- git/objects/submodule/ is empty, so both are identical here. --- The gap The fix for GHSA-hmq2-w58f-27jc added Submodule.validatedname and wired it into update and five siblings,...

cve-2025-48384-poc

CVE-2025-48384 PoC 이 개념 증명은 Git의 CR-path 서브모듈 구문 분석 취약점을 보여주며, git clone --recurse-submodules 중 임의의 훅 실행으로 이어집니다. ⚠️ 경고 이것은 교육 및 테스트 목적으로만 사용됩니다. 프로덕션 환경에서 실행하지 마십시오. 🧪 사용법 git clone https://github.com/yourname/cve-2025-48384-poc.git cd cve-2025-48384 chmod +x generatepoc.sh ./generatepoc.sh cd...

running-CVE-2024-32002-locally-for-tesing

로컬 사용을 위해 이 내용을 적용 중입니다 우리는 이 블로그 게시물을 따르지만 몇 가지 주요 차이점이 있습니다 https://amalmurali.me/posts/git-rce 작동 방식 1. 악성 저장소gitrce에는 특수하게 조작된 경로를 가진 서브모듈이 포함되어 있습니다. 2. 서브모듈 경로는 대소문자를 구분하지 않는 파일 시스템을 악용하는 대소문자 변형을 사용합니다. 3. 서브모듈에는 악성 훅이 포함된 .git/ 디렉터리를 가리키는 심볼릭 링크가 포함되어 있습니다. 4. 저장소를 클론하면 심볼릭 링크가 따라가면서 악성 훅...

CVE-2024-32002

GIT RCE CVE-2024-32002 설명 | CVE-2024-32002 | https://www.tarlogic.com/blog/cve-2024-32002-vulnerability-git/ | 익스플로잇 | 먼저 git에 "calledrepo"와 "commandrepo" 리포지토리를 생성해야 합니다. | 피해자는 나중에 "git clone --recursive calledrepo.git"로 calledrepo를 호출하게 되며, 이는 commandrepo로 리디렉션되어 후크 스크립트를 실행합니다. | 이 bash 리버스쉘...

DEBIAN-CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

UBUNTU-CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689

A flaw was found in GitPython. When updating submodules, GitPython fails to properly validate the submodule path specified in a repository's configuration file. A remote attacker could exploit this vulnerability by supplying a crafted repository containing directory traversal sequences in the...

PT-2026-99360

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.62 Description GitPython fails to validate the path field read from an untrusted .gitmodules file during submodule updates. While constraints exist for the name field and certain operations like add and move, th...

DRUPAL-CONTRIB-2026-161

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user...

PT-2026-97655

Name of the Vulnerable Software and Affected Versions Drupal Webform Entity Print submodule affected versions not specified Description The Webform Entity Print submodule does not sufficiently limit access to its print templates. A user with permissions to create and edit their own webforms can...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user...

Astra Linux – Vulnerability in Git

Git is a version control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted .gitmodules file with submodule URLs that were longer than 1024 characters could be used to exploit a bug in...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: Resources are freed after they are unregistered. The unbind operation of the DP component iterates through the submodules to unregister them and clean up the situation. However, if the unbind occurs because the DP...

Astra Linux – Vulnerability in Git

Git is a fast, scalable, distributed revision control system with an unusually rich command set. It offers both high-level operations and full access to its internal workings. When reading a config value, Git removes any trailing carriage return and line feed CRLF characters. When writing a confi...

Amazon Linux 2023 : mount-s3 (ALAS2023-2026-2137)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2137 advisory. libgit2 Submodule path traversal CVE-2026-53584 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue...

Low: mount-s3

Issue Overview: libgit2 Submodule path traversal CVE-2026-53584 Affected Packages: mount-s3 Issue Correction: Run dnf update mount-s3 --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2137 --releasever 2023.12.20260914 to update your system. More information on how to update yo...