CVE-2019-3902
Mercurial Path Traversal/Link Following vulnerability
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
CVE-2019-3902- CVSS 3.0
- 5.1 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2019-0085
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
EUVD-2019-0085- CVSS 3.0
- 5.1 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mq66-vcfc-8246
Mercurial Path Traversal/Link Following vulnerability
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
GHSA-mq66-vcfc-8246- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22, CWE-59
- Updated
- 2026-11-02
NVD
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
CVE-2019-3902- CVSS 3.0
- 5.1 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-22, CWE-59
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-3902
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
ALPINE-CVE-2019-3902- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVBELL-CVE-2019-3902
CVE-2019-3902 does not affect BellSoft software
- Record
BELL-CVE-2019-3902- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 14 moreShow less
OSV
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
CVE-2019-3902- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-3902
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
DEBIAN-CVE-2019-3902- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-mq66-vcfc-8246
Mercurial Path Traversal/Link Following vulnerability
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
GHSA-mq66-vcfc-8246- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22, CWE-59
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-3902
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
UBUNTU-CVE-2019-3902- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 5.1 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2019-0250 No score
Updated mercurial packages fix security vulnerability
It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use this vulnerability to write arbitrary files to the target’s filesystem (CVE-2019-3902).
- Record
MGASA-2019-0250- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0869-1 No score
Security update for mercurial
This update for mercurial fixes the following issues:
Security issue fixed:
- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0869-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0880-1 No score
Security update for mercurial
This update for mercurial fixes the following issues:
Security issue fixed:
- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0880-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10586-1 No score
mercurial-5.9.1-2.1 on GA media
These are all security issues fixed in the mercurial-5.9.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10586-1- Updated
- 2026-11-02
OSVPYSEC-2019-188 No score
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
- Record
PYSEC-2019-188- Updated
- 2026-11-02
OSVSUSE-SU-2020:1709-1 No score
Security update for mercurial
This update for mercurial fixes the following issues:
Security issue fixed:
- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).
- Record
SUSE-SU-2020:1709-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1709-2 No score
Security update for mercurial
This update for mercurial fixes the following issues:
Security issue fixed:
- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).
- Record
SUSE-SU-2020:1709-2- Updated
- 2026-11-02
OSVSUSE-SU-2020:3003-1 No score
Security update for mercurial
This update for mercurial fixes the following issues:
Security issue fixed:
- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).
- Record
SUSE-SU-2020:3003-1- Updated
- 2026-11-02
OSVUSN-5102-1 No score
mercurial vulnerabilities
It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use this issue to write arbitrary files to the target’s filesystem. (CVE-2019-3902)
It was discovered that Mercurial incorrectly handled certain manifest files. An attacker could use this issue to cause a denial of service and possibly execute arbitrary code. (CVE-2018-17983)
- Record
USN-5102-1- Updated
- 2026-11-02
OSVUSN-5102-2 No score
mercurial vulnerabilities
USN-5102-1 fixed vulnerabilities in Mercurial. This update provides the corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use this issue to write arbitrary files to the target’s filesystem. (CVE-2019-3902)
It was discovered that Mercurial incorrectly handled certain manifest files. An attacker could use this issue to cause a denial of service and possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-17983)
- Record
USN-5102-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mercurialPyPI |
before 4.9 | 4.9 |
mercurialAlpine:v3.10 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.11 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.12 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.13 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.14 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.15 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.16 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.17 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.18 |
before 4.9-r0 | 4.9-r0 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mercurialAlpine:v3.19 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.20 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.21 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.22 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.23 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.24 |
before 4.9-r0 | 4.9-r0 |
mercurialAlpine:v3.7 |
before 4.5.2-r1 | 4.5.2-r1 |
mercurialAlpine:v3.8 |
before 4.6.1-r1 | 4.6.1-r1 |
mercurialAlpine:v3.9 |
before 4.9-r0 | 4.9-r0 |
mercurialDebian:12 |
before 4.9-1 | 4.9-1 |
mercurialDebian:13 |
before 4.9-1 | 4.9-1 |
mercurialDebian:14 |
before 4.9-1 | 4.9-1 |
mercurialDebian:8 |
before 3.1.2-2+deb8u7, plus listed versions 3.1.2-23.1.2-2+deb8u13.1.2-2+deb8u23.1.2-2+deb8u33.1.2-2+deb8u43.1.2-2+deb8u53.1.2-2+deb8u6 |
3.1.2-2+deb8u7 |
mercurialDebian:9 |
before 4.0-1+deb9u2, plus listed versions 4.0-14.0-1+deb9u1 |
4.0-1+deb9u2 |
mercurialPyPI |
before 4.9, plus listed versions 0.8.10.90.9.10.9.20.9.3 Show 45 moreShow less0.9.40.9.51.01.0.11.0.21.11.1.11.1.21.21.2.11.31.3.11.41.4.11.4.21.4.31.51.5.11.5.21.5.31.5.41.61.6.11.6.21.6.31.6.41.71.7.11.7.21.7.31.7.51.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.32.02.0.12.0.22.12.1.1 |
4.9 |
mercurialMageia:6 |
before 4.9.1-1.mga6 | 4.9.1-1.mga6 |
mercurialMageia:7 |
before 4.9.1-1.mga7 | 4.9.1-1.mga7 |
mercurialSUSE:Linux Enterprise Module for Python 2 15 SP1 |
before 4.5.2-3.9.44 | 4.5.2-3.9.44 |
mercurialSUSE:Linux Enterprise Module for Python 2 15 SP2 |
before 4.5.2-3.9.44 | 4.5.2-3.9.44 |
mercurialSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.8.2-15.18.4 | 2.8.2-15.18.4 |
mercurialUbuntu:Pro:14.04:LTS |
before 2.8.2-1ubuntu1.4+esm1, plus listed versions 2.6.3-12.7.2-12.8.1-22.8.2-1ubuntu12.8.2-1ubuntu1.32.8.2-1ubuntu1.4 |
2.8.2-1ubuntu1.4+esm1 |
mercurialUbuntu:Pro:16.04:LTS |
before 3.7.3-1ubuntu1.2+esm2, plus listed versions 3.4-1ubuntu23.6.2-1ubuntu23.7.3-1ubuntu13.7.3-1ubuntu1.13.7.3-1ubuntu1.2 |
3.7.3-1ubuntu1.2+esm2 |
mercurialUbuntu:18.04:LTS |
before 4.5.3-1ubuntu2.2, plus listed versions 4.3.1-24.5-1ubuntu14.5.2-0ubuntu24.5.3-1ubuntu24.5.3-1ubuntu2.1 |
4.5.3-1ubuntu2.2 |
mercurialopenSUSE:Leap 15.1 |
before 4.5.2-lp151.6.3.1 | 4.5.2-lp151.6.3.1 |
mercurialopenSUSE:Leap 15.2 |
before 4.5.2-lp152.7.3.1 | 4.5.2-lp152.7.3.1 |
mercurialopenSUSE:Tumbleweed |
before 5.9.1-2.1 | 5.9.1-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3902 is a medium vulnerability (CVSS 5.1) in Mercurial, published April 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 71st percentile. Fixed in mercurial 4.9.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902
lists.debian.org/debian-lts-announce/2019/04/msg00024.html
mercurial-scm.org/wiki/WhatsNew
usn.ubuntu.com/4086-1
nvd.nist.gov/vuln/detail/CVE-2019-3902
Show 28 moreShow less
github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2019-188.yaml
security.alpinelinux.org/vuln/CVE-2019-3902
docs.bell-sw.com/security/cves/CVE-2019-3902
security-tracker.debian.org/tracker/CVE-2019-3902
advisories.mageia.org/MGASA-2019-0250.html
bugs.mageia.org/show_bug.cgi?id=25291
suse.com/support/update/announcement/2020/suse-su-20201709-1
bugzilla.suse.com/1133035
ubuntu.com/security/CVE-2019-3902
cve.org/CVERecord?id=CVE-2019-3902
lists.opensuse.org/archives/list/[email protected]/thread/LFSY3I5EHDCCHDNTRQLJDPF363GGPOCJ
Left out here: 108 versions. The JSON record has them.