CVE-2023-4759

Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem. This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command. The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration. Setting git configuration option core.symlinks = false before checking out avoids the problem. The issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/  and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ . A backport is available in 5.13.3 starting from 5.13.3.202401111512-r. The JGit maintainers would like to thank RyotaK for finding and reporting this issue.

• CWE-59
• CWE-178
• CWE-59
• CWE-178

• https://git.eclipse.org/c/jgit/jgit.git/commit/?id=9072103f3b3cf64dd12ad2949836ab98f62dabf1Patch, Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11Issue Tracking, Vendor Advisory
• https://projects.eclipse.org/projects/technology.jgit/releases/6.6.1Release Notes, Vendor Advisory
• https://git.eclipse.org/c/jgit/jgit.git/commit/?id=9072103f3b3cf64dd12ad2949836ab98f62dabf1Patch, Vendor Advisory
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11Issue Tracking, Vendor Advisory
• https://projects.eclipse.org/projects/technology.jgit/releases/6.6.1Release Notes, Vendor Advisory

Published

Sep 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47581Out-of-bounds read vulnerability exists in TELLUS V4.0.17.0 …7.8
• CVE-2023-47582Access of uninitialized pointer vulnerability exists in TELL…7.8
• CVE-2023-47583Multiple out-of-bounds read vulnerabilities exist in TELLUS …7.8
• CVE-2023-47584Out-of-bounds write vulnerability exists in V-Server V4.0.18…7.8
• CVE-2023-47585Out-of-bounds read vulnerability exists in V-Server V4.0.18.…7.8
• CVE-2023-47586Multiple heap-based buffer overflow vulnerabilities exist in…7.8
• CVE-2023-4760In Eclipse RAP versions from 3.0.0 up to and including 3.25.…9.8
• CVE-2023-47609SQL injection vulnerability in OSS Calendar versions prior t…8.8
• CVE-2023-4761Out of bounds memory access in FedCM in Google Chrome prior …8.1
• CVE-2023-47610A CWE-120: Buffer Copy without Checking Size of Input vulner…9.8
• CVE-2023-47611A CWE-269: Improper Privilege Management vulnerability exist…7.8
• CVE-2023-47612A CWE-552: Files or Directories Accessible to External Parti…6.1