Threats tagged 'ghsa-6g36-8q6x-8384'

Charmbracelet wish versions before 2.0.5 have a path traversal vulnerability in the git middleware component. This flaw allows authenticated SSH users to bypass directory containment checks by using crafted repository paths with relative directory references. Exploitation enables reading or writing arbitrary repositories outside the intended root directory via git-upload-pack, git-upload-archive, or git-receive-pack.