Wish git middleware path traversal exposes outside repositories
In an SSH server library, logged-in users can peek at or change other repositories.
Summary
A flawed path check in Wish's git middleware lets logged-in SSH users read or write repositories outside the configured repository directory. Versions before 2.0.5 are affected.
Affected when
- SSH user accounts that can log in
- git middleware in use
What to do
Update wish to 2.0.5 or later.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
Times
First published
First seen