CVE-2019-1348

git: Arbitrary path overwriting via export-marks in-stream command feature

Loading…

Severity

Moderate

Red Hat Product Security

3.3

CVSS 3.0

Review impact separately from score.

Published · December 10, 2019

Updated · June 28, 2026

Description

A flaw was found in the git fast-import command where it provides the export-marks feature that may unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input passed to the fast-import command by using the export-marks feature and overwrite arbitrary files, but would not have complete control on the content of the file.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Avoid running git fast-import on untrusted input.

CVSS / CWE

CVSS 3.0 · 3.3
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE-20 · Improper Input Validation