CVE-2025-52569
BaseFortify
Publication date: 2025-06-25
Last updated on: 2025-06-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in GitHub.jl versions prior to 5.9.1, where the GitHub.repo() function does not validate or safely encode the user-provided repo_name input. This allows an attacker to include path traversal sequences like '../' in the repo_name, enabling unauthorized access to unintended endpoints on the api.github.com server. Essentially, improper input validation leads to potential URL manipulation and access to restricted API endpoints. [1]
How can this vulnerability impact me? :
The vulnerability can allow an attacker to access API endpoints on api.github.com that were not intended to be accessible through the GitHub.jl interface. This unauthorized access could lead to exposure of sensitive information or unintended interactions with the GitHub API, potentially compromising data integrity or confidentiality. Users of affected versions should upgrade immediately to mitigate these risks. [1]
What immediate steps should I take to mitigate this vulnerability?
Upgrade GitHub.jl to version 5.9.1 or later immediately, as this version includes fixes that validate and sanitize user inputs to prevent path traversal attacks. No workarounds are available, so upgrading is the only effective mitigation. [1, 2]