CVE-2025-52569: GitForge.jl Path Traversal Vulnerability

CVE-2025-52569 Overview

CVE-2025-52569 is an input validation vulnerability in GitForge.jl, a Julia package providing a unified interface for interacting with Git forges such as GitHub. Versions prior to 5.9.1 fail to validate or safely encode user-supplied values in several functions. The GitHub.repo() function accepts arbitrary strings for the repo_name parameter and forwards them directly to the GitHub API. Attackers can inject path traversal sequences such as ../ to reach unintended endpoints on api.github.com. The issue is tracked as CWE-20: Improper Input Validation and was addressed in version 5.9.1.

Critical Impact
Applications embedding GitForge.jl can be tricked into issuing requests to unintended GitHub API endpoints, enabling access to resources outside the intended repository scope.

Affected Products

GitForge.jl versions prior to 5.9.1
GitHub.jl (JuliaWeb) callers relying on GitHub.repo() and related functions
Julia applications and services that pass untrusted input into GitForge.jl request builders

Discovery Timeline

2025-06-25 - CVE-2025-52569 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52569

Vulnerability Analysis

GitForge.jl composes HTTP requests to api.github.com by concatenating user-provided identifiers directly into URL paths. The GitHub.repo() function accepts a repo_name string without validating its structure or URL-encoding reserved characters. When an application passes attacker-controlled input into this parameter, path traversal sequences such as ../ collapse the intended URL path and redirect the request to a different endpoint on the API host.

This is a classic input validation flaw (CWE-20) with path traversal semantics limited to the trusted API domain. The exposure is confidentiality of data returned by unintended endpoints; integrity and availability of the GitHub API itself are not impacted by the client-side flaw. The Exploit Prediction Scoring System lists the probability at 0.414%.

Root Cause

The root cause is missing input validation and missing URL encoding for user-controlled path segments. GitForge.jl trusts that callers supply well-formed repository identifiers and appends them into request paths without sanitization. See the GitHub Security Advisory GHSA-jg9p-c3wh-q83x for the maintainer's analysis.

Attack Vector

An attacker who controls the repo_name value passed into GitHub.repo() (for example, through a web form, API parameter, or configuration file consumed by a Julia application) supplies a string containing ../ sequences. The resulting request is issued from the application's authenticated GitHub session to an endpoint the developer never intended to call. Because the request carries the application's token, the attacker can enumerate resources accessible under that token's scope.

The vulnerability manifests wherever untrusted input reaches GitForge.jl request builders. See the fix in Pull Request #224 for the sanitization logic added by maintainers.

Detection Methods for CVE-2025-52569

Indicators of Compromise

Outbound HTTPS requests from Julia application hosts to api.github.com paths containing .., %2e%2e, or unexpected endpoint names.
Application logs recording repo_name values that include path separators, URL-encoded traversal sequences, or reserved characters.
GitHub audit log entries showing token usage against endpoints unrelated to the application's normal repositories.

Detection Strategies

Inventory Julia projects and their Project.toml / Manifest.toml files for GitForge.jl versions below 5.9.1.
Review source code for direct passthrough of HTTP request parameters into GitHub.repo() or related GitForge.jl functions.
Enable GitHub organization audit logging and alert on API calls to endpoints outside the application's expected surface.

Monitoring Recommendations

Forward web proxy logs and application-layer HTTP client logs to a central store and query for traversal patterns in outbound GitHub API URLs.
Track token usage anomalies for machine identities that authenticate to the GitHub API from Julia workloads.
Alert on abnormal spikes in distinct api.github.com endpoints contacted by a single application instance.

How to Mitigate CVE-2025-52569

Immediate Actions Required

Upgrade GitForge.jl to version 5.9.1 or later across all Julia environments.
Audit application code paths that accept external input and forward it to GitHub.repo() or similar functions.
Rotate GitHub tokens used by affected applications if traversal patterns are observed in historical logs.

Patch Information

The fix is delivered in GitForge.jl v5.9.1. Maintainers added input validation and safe encoding for user-provided identifiers in Pull Request #224. Refer to the GitHub Security Advisory GHSA-jg9p-c3wh-q83x for the full remediation record. No workarounds are provided by the maintainer.

Workarounds

No official workarounds are available; upgrading is the only supported remediation.
As a defense-in-depth measure, validate repo_name inputs against a strict allowlist (for example, ^[A-Za-z0-9._-]+$) before passing them to GitForge.jl.
Restrict the scope of GitHub tokens used by Julia applications to the minimum required repositories and permissions.

bash

# Update GitForge.jl in the active Julia project
julia -e 'using Pkg; Pkg.update("GitForge"); Pkg.status("GitForge")'

# Verify the installed version is 5.9.1 or later
julia -e 'using Pkg; Pkg.status("GitForge")' | grep -E "GitForge v5\.(9\.[1-9]|[1-9][0-9])"