Most recent entries from all

EUVD-2026-369656

2026-10-06T10:41:34.455635+00:00

EUVD-2026-369656

fkie_cve-2026-50024

2026-10-06T10:41:34.455681+00:00

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server's URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects using the first two characters and remaining characters as path components, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the add_folder and add_task write path in shipped version 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.

GHSA-hr3m-4qwq-3mgc — GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git…

2026-10-06T10:41:34.455753+00:00

Affected: PyPI: githacker

## Summary

GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled `.git/HEAD` before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns any 40-character hex substring into an outbound HTTP `GET` — an existence oracle for arbitrary paths plus hex-fragment exfiltration of file contents.

## Details

### Vulnerability

GitHacker rebuilds a remote `.git/` by fetching files into `temp_dst`. Two functions derived filesystem paths from server-controlled content:

- `add_head_file_tasks` reads the downloaded `.git/HEAD`, parses `ref: `, and joins the raw ref-path onto `temp_dst/.git/logs/` before reading the resulting file. - `add_hashes_parsed` scans any file it reads for 40-character hex substrings and emits `GET .git/objects//` for each one — onto the attacker's server and into the local output tree.

Pre-fix, `add_head_file_tasks` did not validate the ref segments. A malicious `.git/HEAD` of

``` ref: ../../../../../../etc/passwd ```

caused `add_head_file_tasks` to traverse out of `temp_dst` and read `/etc/passwd`. The bytes flowed into `add_hashes_parsed`, which emitted one outbound HTTP request per 40-char-hex match — observable on the attacker's logs.

### Impact

PR #65 originally classified this as arbitrary local file read. Joint analysis during coordinated disclosure narrowed th…

PYSEC-2026-3835 — GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git…

2026-10-06T10:41:34.455868+00:00