CVE-2017-1000115

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

• CWE-59

• http://www.debian.org/security/2017/dsa-3963Third Party Advisory
• http://www.securityfocus.com/bid/100290Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:2489Third Party Advisory
• https://security.gentoo.org/glsa/201709-18Third Party Advisory, VDB Entry
• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29Release Notes, Vendor Advisory
• http://www.debian.org/security/2017/dsa-3963Third Party Advisory
• http://www.securityfocus.com/bid/100290Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:2489Third Party Advisory
• https://security.gentoo.org/glsa/201709-18Third Party Advisory, VDB Entry
• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29Release Notes, Vendor Advisory

Published

Oct 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000109The custom Details view of the Static Analysis Utilities bas…
• CVE-2017-1000110Blue Ocean allows the creation of GitHub organization folder…
• CVE-2017-1000111Linux kernel: heap out-of-bounds in AF_PACKET sockets. This …7.8
• CVE-2017-1000112Linux kernel: Exploitable memory corruption due to UFO to no…7
• CVE-2017-1000113The Deploy to container Plugin stored passwords unencrypted …
• CVE-2017-1000114The Datadog Plugin stores an API key to access the Datadog s…
• CVE-2017-1000116Mercurial prior to 4.3 did not adequately sanitize hostnames…
• CVE-2017-1000117A malicious third-party can give a crafted "ssh://..." URL t…
• CVE-2017-1000118Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept H…
• CVE-2017-1000119October CMS build 412 is vulnerable to PHP code execution in…
• CVE-2017-1000120[ERPNext][Frappe Version <= 7.1.27] SQL injection vulnerabil…
• CVE-2017-1000121The UNIX IPC layer in WebKit, including WebKitGTK+ prior to …9.8