Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2023-25652

High

Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the…

Published May 2, 2023 · Updated Aug 12, 2026 · Also known as ALPINE-CVE-2023-25652, DEBIAN-CVE-2023-25652, DSA-5769-1, GHSA-2hvf-7c8p-28fx, SUSE-SU-2023:2038-1, SUSE-SU-2023:2038-2, SUSE-SU-2023:2062-1, SUSE-SU-2023:2081-1, TR-23-0255, UBUNTU-CVE-2023-25652, USN-6050-1, USN-6050-2

Key Facts

Patch immediately
  • CVE-2023-25652 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Git (Git-Scm), Fedora (Fedoraproject), rootio-git and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 52% probability of exploitation in the next 30 days.
  • Fixed versions are available, including emacs-git 1.8.3.1-25.el7_9, emacs-git-el 1.8.3.1-25.el7_9, Git 0:1.8.3.1-25.el7_9.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS (30-day exploit likelihood)

52%

Higher than 98.9% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2023-25652 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using git apply with --reject when applying patches from an untrusted source. Use git apply --stat to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the *.rej file exists.

Affected Products

446 affected entries in total
ProductAffected versionsFixed in
GitGit-Scm2.40.0, >= < 2.30.92.30.9
FedoraFedoraproject37, 38n/a
rootio-gitrootioSee advisory1:2.30.2-1+deb11u3
git-allamazonSee advisory2.40.1-1.amzn2.0.1
git-coreamazonSee advisory2.40.1-1.amzn2.0.1
20 more affected products in the full CVE brief

Patched Releases

emacs-git

1.8.3.1-25.el7_9

emacs-git-el

1.8.3.1-25.el7_9

Git

0:1.8.3.1-25.el7_9, 0:2.18.4-3.el8_1, 0:2.39.3-1.el9_2, 1:2.17.1-1ubuntu0.18, 1:2.20.1-2+deb10u9, 1:2.25.1-1ubuntu3.11, 1:2.30.2-1+deb11u3, 1:2.34.1-1ubuntu1.9, 1:2.39.5-0+deb12u1, 1:2.40.1-1, 1:2.7.4-0ubuntu1.10+esm7, 1.8.3.1-25.el7_9, 2.26.2-150000.50.1, 2.26.2-27.69.1, 2.32.7-r0, 2.34.8-r0, 2.35.3-150300.10.27.1, 2.36.6-r0, 2.38.5-r0, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1, 2.40.1-r0, 2.43.7-1.ph5, 2.30.9

git-all

1.8.3.1-25.el7_9, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-arch

2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.40.1-1.1

git-bzr

1.8.3.1-25.el7_9

git-core

2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-core-doc

2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-credential-gnome-keyring

2.35.3-150300.10.27.1, 2.40.1-1.1

git-credential-libsecret

2.35.3-150300.10.27.1, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-cvs

1.8.3.1-25.el7_9, 2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-daemon

1.8.3.1-25.el7_9, 2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-doc

2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.40.1-1.1

git-email

1.8.3.1-25.el7_9, 2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-extras

2.43.7-1.ph5

git-gnome-keyring

1.8.3.1-25.el7_9

git-gui

1.8.3.1-25.el7_9, 2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-hg

1.8.3.1-25.el7_9

git-instaweb

1.8.3.1-25.el7_9, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-lang

2.43.7-1.ph5

git-p4

1.8.3.1-25.el7_9, 2.35.3-150300.10.27.1, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-subtree

2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-svn

1.8.3.1-25.el7_9, 2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

git-web

2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.40.1-1.1

gitk

1.8.3.1-25.el7_9, 2.26.2-150000.50.1, 2.26.2-27.69.1, 2.35.3-150300.10.27.1, 2.39.3-1.el8_8, 2.39.3-1.el9_2, 2.40.1-1.1, 2.40.1-1.amzn2.0.1, 2.40.1-1.amzn2023.0.1

Timeline

  1. Publicly disclosed

    May 2, 2023

  2. Last updated

    Aug 12, 2026

Weakness Type

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2023-25652 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo