CVE-2022-24765 Uncontrolled search for the Git directory in Git for Windows

What is CVE-2022-24765?

CVE-2022-24765 is a medium-severity path traversal vulnerability in Apple Xcode, published on 12 Apr 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.

Weakness: CWE-427

Which versions are affected by CVE-2022-24765?

1 open source package ship an affected version, including git. It affects 4 products.

Products include Apple Xcode, Debian Debian Linux, Fedoraproject Fedora, Git-Scm Git.

How do I fix CVE-2022-24765?

Upgrade git to 2.35.2 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-24765 being exploited?

There is no known exploitation of CVE-2022-24765 in the wild and no public exploit code.

Other vulnerabilities in Apple Xcode

• CVE-2025-48384 Git Link Following Exploited High 8.1
• CVE-2014-9390 JGit Improper Input Validation vulnerability Critical 9.8
• CVE-2019-14379 Deserialization of untrusted data in FasterXML jackson-databind Critical 9.8
• CVE-2018-4164 An issue was discovered in certain Apple products. Critical 9.8
• CVE-2016-0746 Use after free in n/a Critical 9.8

All Apple Xcode vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2022-24765, BIT-git-2022-24765, CLEANSTART-2026-EN85312, DEBIAN-CVE-2022-24765, GHSA-vw2c-22j4-2fh2, MGASA-2022-0147 and 11 more.