Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-50024— GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server

Quick assessment

Affected
WangYihang GitHacker
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GitHacker 是一款用于从暴露的 目录中恢复 Git 仓库的工具。在 1.1.7 及更早版本中， 函数会从 文件中解析由攻击者控制的 ref 路径，并将未经校验的路径片段拼接至 目录下。这使得恶意服务器能够诱使受害者在对服务器 URL 运行该工具时，导致 GitHacker 读取任意本地文件。随后， 函数会扫描该文件，查找 40 位长度的十六进制子串，并对每个匹配项通过 发起请求，其中使用前两个字符和其余字符作为路径组件。这会创建一个可被攻击者观察的存在性预言（existence oracle），并泄露匹配的

CVSS 5.3 · Medium EPSS 0.45% · P38

Affected Version Matrix 1

VendorProduct Version RangeStatus
WangYihang GitHacker < 1.1.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50024

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server
Source: CVE Program / CVE List V5
Vulnerability Description
GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server's URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects using the first two characters and remaining characters as path components, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the add_folder and add_task write path in shipped version 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WangYihang GitHacker < 1.1.8 -

II. Public POCs for CVE-2026-50024

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-50024

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-50024 (3)

Vendor Advisories for CVE-2026-50024 (1)

IV. Related Vulnerabilities

Same weakness: CWE-22

V. Comments for CVE-2026-50024

No comments yet

Leave a comment