← Vulnerability feed

Vulnerability record · CVE-2024-32002 · published 14 May 2024

CVE-2024-32002: Git path traversal vulnerability

Git · Git

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

9.0 CVSS 3.1 Critical EPSS 29% · top 1.9% CWE-22 · Path traversalCWE-434 · Unrestricted file upload
9.0CVSS 3.1 base score
29%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
15References
17 Jun 2026Last modified by NVD

Description

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2024/05/14/2
https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt Not Applicable
https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks Not Applicable
https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d Patch
https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
https://lists.fedoraproject.org/archives/list/[email protected]/message/S4CK4IYTXEOBZTEM5K3T6LWOI
http://www.openwall.com/lists/oss-security/2024/05/14/2
https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt Not Applicable
https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks Not Applicable
https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d Patch
https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html
https://lists.fedoraproject.org/archives/list/[email protected]/message/S4CK4IYTXEOBZTEM5K3T6LWOI

Track CVE-2024-32002 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-25648Git argument injection vulnerabilityThe package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) fu…EPSS 4.9%7.5CVE-2024-52005Git vulnerabilityGit is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the …EPSS 0.51%7.5CVE-2020-5260Git improper input validation vulnerabilityAffected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git us…EPSS 10%7.5CVE-2008-5516Git os command injection vulnerabilityThe web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_se…EPSS 4.4%7.5CVE-2008-5517Git code injection vulnerabilityThe web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) gi…EPSS 12%7.5CVE-2008-3546Git memory buffer overflow vulnerabilityStack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrar…EPSS 4.3%7.5CVE-2006-0477Git vulnerabilityBuffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic li…EPSS 3.3%5.0CVE-2009-2108Git vulnerabilitygit-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request contai…EPSS 5.8%

Source: NIST National Vulnerability Database (record CVE-2024-32002), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.