Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-9708

The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user knows or brute-forces the location of the repository.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-9708
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:31 UTC · Revision 1

Source evidence

CVE-2020-9708

core-osv · Original source

Published 14 Aug 2020, 17:15 UTC

The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user knows or brute-forces the location of the repository.

osv:CVE-2020-9708
Complete source record
{
  "id": "e0a572e72692393fcfe3783cb6c5de4c27f60e72aac9499e41f9d1cb6abc1642",
  "url": "https://osv.dev/vulnerability/CVE-2020-9708",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-9708",
    "summary": "The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid Git repository outside the repoRoot. This issue may lead to unauthorized access of private Git repositories as long as the malicious user knows or brute-forces the location of the repository.",
    "evidence": "osv:CVE-2020-9708",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2020-9708",
      "aliases": [
        "CVE-2020-9708",
        "GHSA-cgj4-x2hh-2x93"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/adobe/git-server",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "70fc8451bedf58d8c00a834f189f134b5b601443"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:adobe:git-server:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.3.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.3.0",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.3",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.16",
            "v1.0.15",
            "v1.0.14",
            "v1.0.13",
            "v1.0.12",
            "v1.0.11",
            "v1.0.10",
            "v1.0.9",
            "v1.0.8",
            "v1.0.7",
            "v1.0.6",
            "v1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v0.9.18",
            "v0.9.17",
            "v0.9.16",
            "v0.9.15",
            "v0.9.14",
            "v0.9.13",
            "v0.9.12",
            "v0.9.11",
            "v0.9.10",
            "v0.9.9",
            "v0.9.8",
            "v0.9.7",
            "v0.9.6",
            "v0.9.5",
            "v0.9.4",
            "v0.9.3",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9708.json"
          }
        }
      ],
      "modified": "2026-10-20T10:54:26.908963806Z",
      "provider": "osv",
      "references": [
        "https://github.com/adobe/git-server/security/advisories/GHSA-cgj4-x2hh-2x93"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2020-9708",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 385372,
  "published_at": "2020-08-14T17:15:14.53+00:00"
}