"git apply --reject" partially-controlled arbitrary file write

Summary

Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists.

Timeline

1. Apr 25, 2023, 7:17 PM UTCCVE published
2. Jan 5, 2024, 7:56 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Nov 4, 2025, 4:09 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• git git

  fixed in 2.30.9; From 2.31.0 · fixed in 2.31.8; From 2.32.0 · fixed in 2.32.7; From 2.33.0 · fixed in 2.33.8; From 2.34.0 · fixed in 2.34.8; From 2.35.0 · fixed in 2.35.8; From 2.36.0 · fixed in 2.36.6; From 2.37.0 · fixed in 2.37.7; From 2.38.0 · fixed in 2.38.5; From 2.39.0 · fixed in 2.39.3; From 2.40.0 · fixed in 2.40.1

References 10