PT-2025-26860 · Unknown · Gitforge.Jl

Dilum Aluthge · Published 2025-06-25 · Updated 2025-10-08 · CVE-2025-52569

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GitForge.jl versions prior to 5.9.1

Description: The issue is related to a lack of input validation for user-provided values in certain functions. Specifically, in the GitHub.repo() function, the repo name field can be set to any string, which is then sent directly to the server without validation or safe encoding. This allows for path traversal patterns, such as ../, to be added to the input, potentially accessing unintended endpoints on api.github.com.

Recommendations: For versions prior to 5.9.1, upgrade immediately to v5.9.1 or later to receive a patch. As a temporary workaround, consider restricting the use of the GitHub.repo() function until a patch is available. Avoid using path traversal patterns like ../ in the repo name field to minimize the risk of exploitation.

Exploit

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

BDU:2026-00213

CVE-2025-52569

GHSA-JG9P-C3WH-Q83X

JLSEC-2025-5

Affected Products

Gitforge.Jl

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52569.json · Exploit
• https://osv.dev/vulnerability/JLSEC-2025-5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00213 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52569 · Security Note
• https://github.com/JuliaWeb/GitHub.jl/security/advisories/GHSA-jg9p-c3wh-q83x · Note
• https://github.com/JuliaWeb/GitHub.jl/pull/224 · Note
• https://twitter.com/CVEnew/status/1937922809398727114 · Twitter Post