CVE-2019-3902 MEDIUM

CVE-2019-3902

Vendor The Mercurial Project

Product mercurial

Weakness CWE-22 · Path traversal

Published April 22, 2019

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Local

Attack complexity High

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

Key dates

02Disclosure timeline

April 22, 2019 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-3902 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2025-15589 MuYuCMS Template Management Template.php delete_dir_file path traversal CVE-2018-14806 CVE-2026-23888 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) CVE-2022-2943 WordPress Infinite Scroll – Ajax Load More <= 5.5.3 - Authenticated (Admin+) Arbitrary File Read CVE-2021-47849 Mini Mouse 9.3.0 - Local File inclusion / Path Traversal