CVE-2019-1351 Path traversal in Microsoft Visual Studio 2017
An attacker can exploit improper virtual drive path handling in Git for Visual Studio to tamper with files and potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-1351?
CVE-2019-1351 is a high-severity path traversal vulnerability in Microsoft Visual Studio 2017, published on 24 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.
Weakness: CWE-706
Which versions are affected by CVE-2019-1351?
It affects 3 products.
Products include Microsoft Visual Studio 2017, Microsoft Visual Studio 2019, Opensuse Leap.
How do I fix CVE-2019-1351?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-1351 being exploited?
There is no known exploitation of CVE-2019-1351 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Visual Studio 2017
- CVE-2025-21178 Visual Studio Remote Code Execution Vulnerability
- CVE-2019-1349 Code injection in Microsoft Visual Studio 2017
- CVE-2019-1350 Code injection in Microsoft Visual Studio 2017
- CVE-2019-1352 Code injection in Microsoft Visual Studio 2017
- CVE-2019-1354 Code injection in Microsoft Visual Studio 2017
Sources
Also known as ALPINE-CVE-2019-1351, CLEANSTART-2026-NJ16875, DEBIAN-CVE-2019-1351, GHSA-74x9-89m7-944x, UBUNTU-CVE-2019-1351.