Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N H N 7.5 .0114 66.0 —
AFFECTED Product Versions Fixed git >= 2.39.0, < 2.39.2 – —
TIMELINE Jan 19 Reserved by GitHub_M Feb 14 Published (CNA: GitHub_M) Oct 8 RESCORED — CVE-2023-23946 (git). CVSS 6.2 → 7.5 (NVD).
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.
| Date | Event | Detail |
|---|---|---|
| January 19, 2023 | Reserved | Reserved by GitHub_M |
| February 14, 2023 | Published | Published (CNA: GitHub_M) |
| October 8, 2026 | RESCORED | RESCORED — CVE-2023-23946 (git). CVSS 6.2 → 7.5 (NVD). |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| git | git | — | >= 2.39.0, < 2.39.2 | — |
Authoritative record: CVE-2023-23946 at cve.org
Vendors: git
Weaknesses: CWE-22
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-23946 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
