CVE-2020-12278

An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.

• CWE-706

• https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vjThird Party Advisory
• https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776ed01Patch, Third Party Advisory
• https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cbPatch, Third Party Advisory
• https://github.com/libgit2/libgit2/releases/tag/v0.28.4Release Notes, Third Party Advisory
• https://github.com/libgit2/libgit2/releases/tag/v0.99.0Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html
• https://github.com/git/git/security/advisories/GHSA-5wph-8frv-58vjThird Party Advisory
• https://github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776ed01Patch, Third Party Advisory
• https://github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cbPatch, Third Party Advisory
• https://github.com/libgit2/libgit2/releases/tag/v0.28.4Release Notes, Third Party Advisory
• https://github.com/libgit2/libgit2/releases/tag/v0.99.0Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/02/msg00034.html

Published

Apr 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12272OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject…5.3
• CVE-2020-12273In TestLink 1.9.20, a crafted login.php viewer parameter exp…7.5
• CVE-2020-12274In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback…9.8
• CVE-2020-12275GitLab 12.6 through 12.9 is vulnerable to a privilege escala…5.3
• CVE-2020-12276GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an …4.8
• CVE-2020-12277GitLab 10.8 through 12.9 has a vulnerability that allows som…5.3
• CVE-2020-12279An issue was discovered in libgit2 before 0.28.4 and 0.9x be…9.8
• CVE-2020-1228<p>A denial of service vulnerability exists in Windows DNS w…7.5
• CVE-2020-12280iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12281iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12282iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca par…8.8
• CVE-2020-12283Sourcegraph before 3.15.1 has a vulnerable authentication wo…6.1