CVE-2007-3846
Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5...
Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository.
- Record
CVE-2007-3846- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository.
- Record
CVE-2007-3846- Updated
- 2026-11-02
EUVDEUVD-2007-3830 No score
Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository.
- Record
EUVD-2007-3830- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q2fr-786f-crqr No score
Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5...
Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository.
- Record
GHSA-q2fr-786f-crqr- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3846 is a medium vulnerability (CVSS 6.0) in Subversion, published August 28, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2007/3004
subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
tortoisesvn.net/node/291
secunia.com/advisories/26632
securityfocus.com/bid/25468
crisp.cs.du.edu?q=node/36
Show 9 moreShow less
osvdb.org/40119
securitytracker.com/id?1018617
exchange.xforce.ibmcloud.com/vulnerabilities/36312
nvd.nist.gov/vuln/detail/CVE-2007-3846
github.com/advisories/GHSA-q2fr-786f-crqr