CVE-2026-50024
Received Received - Intake

Path Traversal in GitHacker Tool

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server's URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects using the first two characters and remaining characters as path components, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the add_folder and add_task write path in shipped version 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-50024
EUVD
EUVD-2026-78777

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
wangyihang githacker 1.1.7
wangyihang githacker 1.1.8
wangyihang githacker 1.1.9
githacker githacker to 1.1.9 (exc)
githacker githacker 1.1.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitHacker before version 1.1.8 has a path traversal flaw in how it parses .git/HEAD ref paths. An attacker can craft malicious paths in .git/HEAD to trick GitHacker into reading arbitrary local files on the victim's system. The tool also scans accessed files for 40-character hex strings and sends HTTP requests for matches, creating an existence oracle and partial data leak channel.

Detection Guidance

To detect this vulnerability, check if you are running GitHacker version 1.1.7 or earlier. Run: git clone https://github.com/WangYihang/GitHacker.git && cd GitHacker && git log --oneline | grep 5f2a8ba. If the commit is missing, the vulnerable version is installed. Also inspect .git/HEAD files for malicious path traversal sequences like ../../../../etc/passwd.

Impact Analysis

An attacker could read sensitive files like /etc/passwd or /etc/shadow if you run GitHacker against a malicious repository. It also leaks partial file contents via HTTP requests if files contain 40-character hex sequences, such as Git refs or password hashes. The attack requires victim interaction to run GitHacker against an attacker-controlled URL.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Partial data exposure via the existence oracle may still constitute a compliance breach depending on the data involved.

Mitigation Strategies

Upgrade GitHacker to version 1.1.9 or later. Avoid running the tool against untrusted repositories. Use disposable containers for execution. Validate .git/HEAD files for path traversal sequences before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50024. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart