CveMateVulnerability intelligence

CVE-2020-27955: git_large_file_storage_project git_large_file_storage Uncontrolled Search Path Element

CVSS: 10.0v2.0HighModified

AliasesGHSA-4g4p-42wc-9f3mBIT-git-lfs-2020-27955

Published 05-11-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-27955 is a high (CVSS 10.0) Uncontrolled Search Path Element vulnerability in git_large_file_storage_project git_large_file_storage. EPSS estimates a 82.32% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 6 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

82.32%

0%100%

Critical · -0.39 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits6reference, metasploit

Timeline

05-11-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

Git LFS 2.12.0 allows Remote Code Execution.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.19.8v2.010.0

EPSS trend

Probability

82.32%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.39 pp

From 82.72% on 20-09-2026

20-09-202620-10-2026

EPSS score

82.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

6 found

referenceUnverified
Exploit Reference (exploitbox.io)
Maturity: unknown
referenceUnverified
Exploit Reference (legalhackers.com)
Maturity: unknown
referenceUnverified
Exploit Reference (seclists.org)
Maturity: unknown

Show all 6 exploits

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
MetasploitremoteVerified
Git Remote Code Execution via git-lfs (CVE-2020-27955)
exploit/windows/http/git_lfs_rce
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Affected systems

Git_large_file_storage_project1 product

git_large_file_storage2.12.0

Github.com/git-lfs1 product

git-lfs< 2.12.1

2 vendors · 2 products

References

10 links

legalhackers.comX Refsource MISCThird Party Advisory
exploitbox.ioX Refsource MISCExploitThird Party Advisory
github.com/git-lfs/git-lfs/releasesX Refsource MISCWEBRelease NotesThird Party Advisory
legalhackers.com/advisories/Git-LFS-RCE-Exploit-CVE-2020-27955.htmlX Refsource MISCWEBExploitThird Party Advisory
seclists.org/fulldisclosure/2020/Nov/1Mailing ListX Refsource FULLDISCWEBExploitThird Party Advisory
packetstormsecurity.com/files/159923/git-lfs-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
packetstormsecurity.com/files/164180/Git-git-lfs-Remote-Code-Execution.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
github.com/git-lfs/git-lfs/security/advisories/GHSA-4g4p-42wc-9f3mWEB
nvd.nist.gov/vuln/detail/CVE-2020-27955Advisory
github.com/git-lfs/git-lfsPACKAGE