Description
Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mercurial | 1.0.1-2 | — |
| Debian 13 | mercurial | 1.0.1-2 | — |
| Debian 12 | mercurial | 1.0.1-2 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | mercurial | 5.9.1-2.1 | openSUSE-SU-2024:10586-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | mercurial | < 1.0.2 | 1.0.2 | GHSA-v2gw-x5jf-pgwv |
Advisories 1
- openSUSE-SU-2024:10586-1 mercurial-5.9.1-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.selenic.com/hg/rev/87c704ac92d4
- mercurial-patch-directory-traversal(43551) vdb-entry
- 30072 vdb-entry
- https://issues.rpath.com/browse/RPL-2633
- [oss-security] 20080630 CVE id request mercurial:Insufficient input validation mailing-list
- SUSE-SR:2008:015 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2008-0211
- 20080703 rPSA-2008-0211-1 mercurial mercurial-hgk mailing-list
- GLSA-200807-09 vendor-advisory
- [oss-security] 20080701 Re: CVE id request mercurial:Insufficient input validation mailing-list
- 31110 third-party-advisory
- 31167 third-party-advisory
- 31108 third-party-advisory