Description
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| git-for-windows | git | < 2.35.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | git | 1:2.35.2-1 | — |
| Debian 13 | git | 1:2.35.2-1 | — |
| Debian 12 | git | 1:2.35.2-1 | — |
| Debian 11 | git | 1:2.30.2-1+deb11u1 | DSA-5332-1 |
| Debian 10 | git | 1:2.20.1-2+deb10u5 | DLA-3239-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | git | 1:2.34.1-1ubuntu1.2 | USN-5376-2 |
| Ubuntu 20.04 LTS | git | 1:2.25.1-1ubuntu3.4 | USN-5376-1 |
| Ubuntu 18.04 LTS | git | 1:2.17.1-1ubuntu0.11 | USN-5376-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | git +14 | 2.39.1-1.el9 | RHSA-2023:2319 |
| RHEL 8 | git +14 | 2.39.1-1.el8 | RHSA-2023:2859 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.6 EUS | git +14 | 2.31.8-1.el8_6 | RHSA-2024:0407 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | git +14 | 2.39.1-1.el9 | ALSA-2023:2319 |
| AlmaLinux 8 | git +14 | 2.39.1-1.el8 | ALSA-2023:2859 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | libgit2 | 1.3.0-150400.3.3.1 | SUSE-SU-2022:3283-1 |
| SLES 15 SP3 | git | 2.35.3-150300.10.12.1 | SUSE-SU-2022:1484-1 |
| SLES 15 SP3 | libgit2 | 0.28.4-150200.3.3.1 | SUSE-SU-2022:3494-1 |
| SLES 15 SP2 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLES 15 SP2 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1 |
| SLES 15 SP1 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLES 15 SP1 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1 |
| SLES 15 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLES 15 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1 |
Show 27 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SLES 12 SP4 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SLES 12 SP3 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SLES 12 SP2 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SLES for SAP 15 SP2 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLES for SAP 15 SP2 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1 |
| SLES for SAP 15 SP1 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLES for SAP 15 SP1 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1 |
| SLES for SAP 15 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLES for SAP 15 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1 |
| SLES for SAP 12 SP5 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SLES for SAP 12 SP4 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SLES for SAP 12 SP3 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SLE Real Time 15 SP2 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLE HPC 15 SP2 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLE HPC 15 SP2 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1 |
| SLE HPC 15 SP1 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLE HPC 15 SP1 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1 |
| SLE HPC 15 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SLE HPC 15 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1 |
| SUSE OpenStack Cloud Crowbar 9 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SUSE OpenStack Cloud Crowbar 8 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SUSE OpenStack Cloud 9 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SUSE OpenStack Cloud 8 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SUSE Manager Server Module 4.3 | libgit2 | 0.28.4-150200.3.3.1 | SUSE-SU-2022:3494-1 |
| SUSE Manager Server Module 4.2 | libgit2 | 0.28.4-150200.3.3.1 | SUSE-SU-2022:3494-1 |
| SUSE Manager Server Module 4.1 | libgit2 | 0.28.4-150200.3.3.1 | SUSE-SU-2022:3494-1 |
| SUSE Manager Server 4.1 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SUSE Manager Server 4.1 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1 |
| SUSE Manager Retail Branch Server 4.1 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SUSE Manager Retail Branch Server 4.1 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1 |
| SUSE Manager Proxy 4.1 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SUSE Manager Proxy 4.1 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1 |
| SUSE HPE Helion OpenStack 8 | git | 2.26.2-27.52.1 | SUSE-SU-2022:1306-1 |
| SUSE Enterprise Storage 7 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SUSE Enterprise Storage 7 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1 |
| SUSE Enterprise Storage 6 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1260-1 |
| SUSE Enterprise Storage 6 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | git | 2.35.3-1.1 | openSUSE-SU-2024:12003-1 |
| openSUSE Tumbleweed | git-annex | 10.20220624-1.1 | openSUSE-SU-2024:12223-1 |
| openSUSE Tumbleweed | libgit2 | 1.4.3-1.1 | openSUSE-SU-2024:12005-1 |
| openSUSE Leap 15.4 | git | 2.35.3-150300.10.12.1 | SUSE-SU-2022:1484-1 |
| openSUSE Leap 15.4 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1, SUSE-SU-2022:3283-1 |
| openSUSE Leap 15.3 | git | 2.26.2-150000.36.1 | SUSE-SU-2022:1484-1, SUSE-SU-2022:1260-1 |
| openSUSE Leap 15.3 | libgit2 | 0.26.8-150000.3.15.1 | SUSE-SU-2022:3495-1, SUSE-SU-2022:3494-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | git | 2.35.2-r0 | — |
| Alpine v3.24 | libgit2 | 1.4.4-r0 | — |
| Alpine v3.23 | git | 2.35.2-r0 | — |
| Alpine v3.23 | libgit2 | 1.4.4-r0 | — |
| Alpine v3.22 | git | 2.35.2-r0 | — |
| Alpine v3.22 | libgit2 | 1.4.4-r0 | — |
| Alpine v3.21 | git | 2.35.2-r0 | — |
| Alpine v3.21 | libgit2 | 1.4.4-r0 | — |
| Alpine v3.20 | git | 2.35.2-r0 | — |
| Alpine v3.20 | libgit2 | 1.4.4-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | git | 2.35.2-r0 | — |
| Alpine v3.19 | libgit2 | 1.4.4-r0 | — |
| Alpine v3.18 | git | 2.35.2-r0 | — |
| Alpine v3.18 | libgit2 | 1.4.4-r0 | — |
| Alpine v3.17 | git | 2.35.2-r0 | — |
| Alpine v3.17 | libgit2 | 1.4.4-r0 | — |
| Alpine v3.16 | git | 2.35.2-r0 | — |
| Alpine v3.15 | git | 2.34.2-r0 | — |
| Alpine v3.14 | git | 2.32.1-r0 | — |
| Alpine v3.13 | git | 2.30.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | git +16 | 2.39.1-1.amzn2023.0.2 | ALAS2023-2023-065 |
| Amazon Linux 2 | git +16 | 2.34.3-1.amzn2.0.2 | ALAS2-2022-1810 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | git +14 | 2.39.1-1.el9 | ELSA-2023-2319 |
| Oracle Linux 8 | git +14 | 2.39.1-1.el8 | ELSA-2023-2859 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
federiconbaez/cortex9-git-safe-directory-discovery-model ★ 0 · Nov 6, 2026
In-memory model of git repository discovery and the safe.directory ownership check (CVE-2022-24765). Never runs git or touches the real FS.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 25
- ALSA-2023:2319 Moderate: git security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:2859 Moderate: git security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:0407 Red Hat Security Advisory: git security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2023:2859 Red Hat Security Advisory: git security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2023:2319 Red Hat Security Advisory: git security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-5332-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3239-1 git - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-0252 git: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Mar 2, 2026
- USN-5376-1 git vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-5376-2 git vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2022:1260-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12005-1 libgit2-1_4-1.4.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3494-1 Security update for libgit2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3495-1 Security update for libgit2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1306-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3283-1 Security update for libgit2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:1484-1 Security update for git SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12003-1 git-2.35.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12223-1 git-annex-10.20220624-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- VDE-2023-016 Phoenix Contact: PLCnext Engineer Vulnerabilities in LibGit2Sharp/LibGit2 CERT@VDE · May 22, 2025
- ELSA-2023-2859 Moderate: git security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 23, 2023
- WID-SEC-2023-0561 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023
- ELSA-2023-2319 Moderate: git security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023
- ALAS2023-2023-065 Important: git security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ALAS2-2022-1810 Moderate: git security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 14, 2022
References
- https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2
- https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash
- https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode
- [oss-security] 20220412 git v2.35.2 and friends for CVE-2022-24765 mailing-list
- FEDORA-2022-e99ae504f5 vendor-advisory
- FEDORA-2022-3759ebabd2 vendor-advisory
- FEDORA-2022-2fec5f30be vendor-advisory
- https://support.apple.com/kb/HT213261
- 20220516 APPLE-SA-2022-05-16-8 Xcode 13.4 mailing-list
- FEDORA-2022-dfd7e7fc0e vendor-advisory
- FEDORA-2022-2a5de7cb8b vendor-advisory
- [debian-lts-announce] 20221213 [SECURITY] [DLA 3239-1] git security update mailing-list
- FEDORA-2023-470c7ea49e vendor-advisory
- FEDORA-2023-e3c8abd37e vendor-advisory
- FEDORA-2023-1068309389 vendor-advisory
- FEDORA-2023-3ec32f6d4e vendor-advisory
- GLSA-202312-15 vendor-advisory