CVE-2026-50024: GitHacker Path Traversal Vulnerability

CVE-2026-50024 Overview

CVE-2026-50024 is a path traversal vulnerability [CWE-22] in GitHacker, an open-source tool that reconstructs Git repositories from exposed .git directories. Versions 1.1.7 and earlier fail to validate the ref path parsed from .git/HEAD, allowing a malicious server to coerce GitHacker into reading arbitrary local files on the victim's system. The tool then scans the referenced file for 40-character hexadecimal substrings and requests each one back through the attacker's server, creating an existence oracle that discloses matching hexadecimal fragments. The issue is fixed in repository version 1.1.9.

Critical Impact
A malicious Git server can cause a GitHacker client to leak the presence of 40-character hex substrings from arbitrary readable files on the local system.

Affected Products

GitHacker versions 1.1.7 and earlier
Fixed in GitHacker repository version 1.1.9
Users invoking GitHacker against untrusted URLs

Discovery Timeline

2026-09-15 - CVE-2026-50024 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-50024

Vulnerability Analysis

GitHacker recovers exposed .git directories by fetching well-known Git object paths from a target server. The add_head_file_tasks function reads .git/HEAD, extracts the referenced path, and joins those segments onto the local working directory temp_dst/.git/logs/ without sanitization. Because the ref path is attacker-controlled, a malicious server can supply values containing .. sequences that resolve outside the intended log directory.

Once GitHacker reads the referenced file, the add_hashes_parsed routine scans its contents for 40-character hexadecimal substrings. Every match is treated as a Git object hash. GitHacker requests each candidate hash through .git/objects/<first-two-chars>/<remaining-chars> on the attacker's server. This turns the client into an oracle that reveals which hexadecimal fragments exist inside targeted local files.

Complete file contents are not returned to the attacker. Only 40-character hex substrings are disclosed through the request pattern. The add_folder and add_task write path in version 1.1.7 does not permit directory escape, so the impact is limited to read-side disclosure.

Root Cause

The root cause is missing input validation on data parsed from the remote .git/HEAD file. GitHacker trusts server-supplied ref paths and uses os.path.join-style concatenation without normalizing or restricting the result to the intended base directory.

Attack Vector

An attacker hosts a Git-like directory structure at a URL and convinces a victim to run GitHacker against it. The malicious HEAD response contains a ref path with traversal segments pointing at a sensitive local file. GitHacker reads the file, extracts hex substrings, and issues object requests back to the server, disclosing matches to the attacker.

The vulnerability requires no authentication and is exploitable over the network, but success depends on the victim executing the tool against attacker-controlled infrastructure.

See the GitHub Security Advisory GHSA-hr3m-4qwq-3mgc for the maintainer's technical write-up.

Detection Methods for CVE-2026-50024

Indicators of Compromise

Outbound HTTP requests from a GitHacker host to .git/objects/<xx>/<38-hex-chars> paths on untrusted domains.
Presence of GitHacker version 1.1.7 or earlier in developer or analyst tooling inventories.
Local .git/HEAD scratch files under GitHacker working directories containing .. sequences in ref values.

Detection Strategies

Inspect network telemetry for GitHacker user-agent strings correlated with requests to unfamiliar hosts.
Audit endpoints where security researchers or DevOps engineers run recovery tooling against unvetted URLs.
Alert on process executions of githacker with target URLs outside an approved allowlist.

Monitoring Recommendations

Log all invocations of Git recovery utilities and correlate with outbound DNS and HTTP requests.
Track filesystem reads originating from GitHacker processes against paths outside the intended working directory.
Review proxy logs for sequential requests to .git/objects/ hex paths, which indicate hash enumeration activity.

How to Mitigate CVE-2026-50024

Immediate Actions Required

Upgrade GitHacker to repository version 1.1.9 or later.
Inventory workstations and CI runners for installed GitHacker versions 1.1.7 or earlier and remove or update them.
Restrict use of GitHacker to trusted target URLs, ideally from isolated analysis environments.

Patch Information

The fix is available in the upstream repository at version 1.1.9. The maintainer merged the corrective changes in GitHub Pull Request 65, with implementation in commits 16fcd81 and 5f2a8ba. These patches validate ref path segments parsed from .git/HEAD before joining them onto the local working directory.

Workarounds

Run GitHacker inside an ephemeral container or virtual machine with no access to sensitive files.
Execute the tool under a low-privilege service account with a restricted filesystem view.
Route GitHacker traffic through a proxy that blocks requests to non-approved destinations.

bash

# Configuration example
# Upgrade to the fixed repository version
pip install --upgrade 'git+https://github.com/WangYihang/GitHacker@1.1.9'

# Verify installed version
githacker --version