CVE-2023-22490Public exploit

File disclosure via top-level objects symlink traversal

Published Feb 14, 2023 · Updated Feb 13, 2025

Information disclosure in Git 2.39.1 and earlier allows attackers to expose files at known paths through a crafted repository clone. Git misclassifies an ambiguous submodule transport as local, then follows a top-level $GIT_DIR/objects symbolic link while copying objects into the clone. Exploitation requires a victim to clone an untrusted repository with recursive submodules; the resulting working copy can contain readable local files at attacker-known paths.

CVSS severity5.5

Medium

EPSS probability0.71%

Next 30 days · Sep 16, 2026

Known exploitationUnconfirmed

Based on sourced intelligence

Hinoki checkNot available

Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

The record

CVE: CVE-2023-22490
Published: Feb 14, 2023
Updated: Feb 13, 2025

Vendor: Git
Product: Git
Classifications: CWE-59, T1005

Attack vector: local
Privileges: unauthenticated

Timeline

How it unfolded

Feb 14, 2023CVE publishedPublication date reported by the CVE source.
Feb 13, 2025Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

Affected versionversion=< 2.30.8
Affected versionversion=>= 2.31.0, < 2.31.7
Affected versionversion=>= 2.32.0, < 2.32.6
Affected versionversion=>= 2.33.0, < 2.33.7
Affected versionversion=>= 2.34.0, < 2.34.7
Affected versionversion=>= 2.35.0, < 2.35.7
Affected versionversion=>= 2.36.0, < 2.36.5
Affected versionversion=>= 2.37.0, < 2.37.6
Affected versionversion=>= 2.38.0, < 2.38.4
Affected versionversion=>= 2.39.0, < 2.39.2

What conditions does exploitation require?

Attack vectorlocal

Required privilegesunauthenticated

What is affected?

Git · Gitversion=< 2.30.8; version=>= 2.31.0, < 2.31.7; version=>= 2.32.0, < 2.32.6; version=>= 2.33.0, < 2.33.7; version=>= 2.34.0, < 2.34.7; version=>= 2.35.0, < 2.35.7; version=>= 2.36.0, < 2.36.5; version=>= 2.37.0, < 2.37.6; version=>= 2.38.0, < 2.38.4; version=>= 2.39.0, < 2.39.2

Published CVSS scores

5.5GitHub, Inc.CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5.5NIST NVDCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 9, 2026Sep 15, 2026

Latest reporting daySep 15, 2026

Latest daily unique IPsUnavailable

Prior 30-day averageUnavailable

SourceShadowserver honeypots (KEV)

Vectorlocal

Privilegesunauthenticated

Known exploitationUnconfirmed

Public exploitPublished

Weakness, pattern, technique

CWE-59Improper Link Resolution Before File Access ('Link Following')

T1005Data from Local System

Public exploit references

Upstream ambiguous-transport regression testproof of concept · demonstrated

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo