Critical severity9.8NVD Advisory· Published Apr 27, 2020· Updated Jun 17, 2026
CVE-2020-12278
CVE-2020-12278
Description
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- libgit2/libgit2description
- Range: <0.28.4, <0.99.0
Patches
Vulnerability mechanics
References
7- github.com/libgit2/libgit2/commit/3f7851eadca36a99627ad78cbe56a40d3776ed01nvdPatchThird Party Advisory
- github.com/libgit2/libgit2/commit/e1832eb20a7089f6383cfce474f213157f5300cbnvdPatchThird Party Advisory
- github.com/git/git/security/advisories/GHSA-5wph-8frv-58vjnvdThird Party Advisory
- github.com/libgit2/libgit2/releases/tag/v0.28.4nvdRelease NotesThird Party Advisory
- github.com/libgit2/libgit2/releases/tag/v0.99.0nvdRelease NotesThird Party Advisory
- lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2023/02/msg00034.htmlnvd
News mentions
0No linked articles in our index yet.