{"id":"CVE-2019-3902","aliases":["ALPINE-CVE-2019-3902","BELL-CVE-2019-3902","DEBIAN-CVE-2019-3902","DLA-1764-1","DLA-2293-1","EUVD-2019-0085","GHSA-mq66-vcfc-8246","MGASA-2019-0250","PYSEC-2019-188","SUSE-SU-2020:1709-1","SUSE-SU-2020:1709-2","SUSE-SU-2020:3003-1","UBUNTU-CVE-2019-3902","USN-5102-1","USN-5102-2","openSUSE-SU-2020:0869-1","openSUSE-SU-2020:0880-1","openSUSE-SU-2024:10586-1"],"status":"published","title":"Mercurial Path Traversal/Link Following vulnerability","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","severity":{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01362,"percentile":0.71971,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2019-04-22T00:00:00Z","modified":"2026-11-03T06:31:58Z","fixes":[{"ecosystem":"PyPI","package":"mercurial","fixed_in":["4.9"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"mercurial","fixed_in":["4.5.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"mercurial","fixed_in":["4.6.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"mercurial","fixed_in":["4.9-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mercurial","fixed_in":["4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mercurial","fixed_in":["4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mercurial","fixed_in":["4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"mercurial","fixed_in":["3.1.2-2+deb8u7"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"mercurial","fixed_in":["4.9.1-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"mercurial","fixed_in":["4.9.1-1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP1","package":"mercurial","fixed_in":["4.5.2-3.9.44"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP2","package":"mercurial","fixed_in":["4.5.2-3.9.44"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"mercurial","fixed_in":["2.8.2-15.18.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mercurial","fixed_in":["2.8.2-1ubuntu1.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mercurial","fixed_in":["3.7.3-1ubuntu1.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"mercurial","fixed_in":["4.5.3-1ubuntu2.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"mercurial","fixed_in":["4.5.2-lp151.6.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"mercurial","fixed_in":["4.5.2-lp152.7.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2+deb8u7"}]}],"versions":["3.1.2-2","3.1.2-2+deb8u1","3.1.2-2+deb8u2","3.1.2-2+deb8u3","3.1.2-2+deb8u4","3.1.2-2+deb8u5","3.1.2-2+deb8u6"]},{"source":"osv","ecosystem":"Debian:9","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-1+deb9u2"}]}],"versions":["4.0-1","4.0-1+deb9u1"],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.3","3.3-rc","3.3.1","3.3.2","3.3.3","3.4","3.4-rc","3.4.1","3.4.2","3.5","3.5-rc","3.5.1","3.5.2","3.6","3.6-rc","3.6.1","3.6.2","3.6.3","3.7","3.7-rc","3.7.1","3.7.2","3.7.3","3.8","3.8-rc","3.8.1","3.8.2","3.8.3","3.8.4","3.9","3.9-rc","3.9.1","3.9.2","4.0","4.0-rc","4.0.1","4.0.2","4.1","4.1-rc","4.1.1","4.1.2","4.1.3","4.2","4.2-rc","4.2.1","4.2.2","4.2.3","4.3","4.3-rc","4.3.1","4.3.2","4.3.3","4.3rc0","4.4","4.4-rc","4.4.1","4.4.2","4.4rc0","4.5","4.5-rc","4.5.1","4.5.2","4.5.3","4.5rc0","4.6","4.6.1","4.6.2","4.6rc0","4.6rc1","4.7","4.7.1","4.7.2","4.7rc0","4.8","4.8.1","4.8.2","4.8rc0","4.9rc0"]},{"source":"osv","ecosystem":"Mageia:6","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1.mga7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.3","3.3-rc","3.3.1","3.3.2","3.3.3","3.4","3.4-rc","3.4.1","3.4.2","3.5","3.5-rc","3.5.1","3.5.2","3.6","3.6-rc","3.6.1","3.6.2","3.6.3","3.7","3.7-rc","3.7.1","3.7.2","3.7.3","3.8","3.8-rc","3.8.1","3.8.2","3.8.3","3.8.4","3.9","3.9-rc","3.9.1","3.9.2","4.0","4.0-rc","4.0.1","4.0.2","4.1","4.1-rc","4.1.1","4.1.2","4.1.3","4.2","4.2-rc","4.2.1","4.2.2","4.2.3","4.3","4.3-rc","4.3.1","4.3.2","4.3.3","4.3rc0","4.4","4.4-rc","4.4.1","4.4.2","4.4rc0","4.5","4.5-rc","4.5.1","4.5.2","4.5.3","4.5rc0","4.6","4.6.1","4.6.2","4.6rc0","4.6rc1","4.7","4.7.1","4.7.2","4.7rc0","4.8","4.8.1","4.8.2","4.8rc0","4.9rc0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP1","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-3.9.44"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP2","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-3.9.44"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-15.18.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1ubuntu1.4+esm1"}]}],"versions":["2.6.3-1","2.7.2-1","2.8.1-2","2.8.2-1ubuntu1","2.8.2-1ubuntu1.3","2.8.2-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1ubuntu1.2+esm2"}]}],"versions":["3.4-1ubuntu2","3.6.2-1ubuntu2","3.7.3-1ubuntu1","3.7.3-1ubuntu1.1","3.7.3-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu2.2"}]}],"versions":["4.3.1-2","4.5-1ubuntu1","4.5.2-0ubuntu2","4.5.3-1ubuntu2","4.5.3-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu2.2"}]}],"versions":["4.3.1-2","4.5-1ubuntu1","4.5.2-0ubuntu2","4.5.3-1ubuntu2","4.5.3-1ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1ubuntu1.4+esm1"}]}],"versions":["2.6.3-1","2.7.2-1","2.8.1-2","2.8.2-1ubuntu1","2.8.2-1ubuntu1.3","2.8.2-1ubuntu1.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1ubuntu1.2+esm2"}]}],"versions":["3.4-1ubuntu2","3.6.2-1ubuntu2","3.7.3-1ubuntu1","3.7.3-1ubuntu1.1","3.7.3-1ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-lp151.6.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-lp152.7.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-2.1"}]}],"bundled":9}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mercurial","product":"mercurial"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"the mercurial project","product":"mercurial"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/04/msg00024.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://usn.ubuntu.com/4086-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3902","tags":["advisory"]},{"url":"https://usn.ubuntu.com/4086-1","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2019-188.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mq66-vcfc-8246","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-3902","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-3902","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3902","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0250.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25291","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133035","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3902","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201709-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203003-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3902","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4086-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5102-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3902","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5102-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-17983","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LFSY3I5EHDCCHDNTRQLJDPF363GGPOCJ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PA2RVS77V4TKQO7OXBV77XU3TO42EEGU/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17983","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3902","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2019-04-22T15:29:13Z","modified":"2024-08-04T19:26:26.699Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-0085","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2019-04-22T15:29:13Z","modified":"2024-08-04T19:26:26Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T03:06:54.362786Z"}],"ghsa":[{"id":"GHSA-mq66-vcfc-8246","title":"Mercurial Path Traversal/Link Following vulnerability","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2022-02-15T01:13:11Z","modified":"2024-09-25T19:41:31Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:38:06.29677Z"}],"nvd":[{"id":"CVE-2019-3902","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2019-04-22T16:29:01.913Z","modified":"2026-06-17T02:35:50.26Z","cvss":[{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:05:12.471695Z"}],"osv":[{"id":"ALPINE-CVE-2019-3902","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2019-04-22T16:29:01.913Z","modified":"2026-11-03T06:31:58.589951593Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"BELL-CVE-2019-3902","title":"CVE-2019-3902 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:41.564299Z","modified":"2026-01-26T09:47:39.951063Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-3902","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2019-04-22T16:29:01.913Z","modified":"2026-04-16T04:31:25.932763142Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3902","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2019-04-22T16:29:01.913Z","modified":"2026-09-21T07:01:11.312190229Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-mq66-vcfc-8246","title":"Mercurial Path Traversal/Link Following vulnerability","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2022-02-15T01:13:11Z","modified":"2024-09-25T19:48:14.490371Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"UBUNTU-CVE-2019-3902","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2019-04-22T00:00:00Z","modified":"2026-03-14T08:55:47.648965Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"},{"version":"3.0","score":5.1,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DLA-1764-1","title":"mercurial - security update","status":"published","published":"2019-04-25T00:00:00Z","modified":"2026-03-09T01:18:16.652542Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2293-1","title":"mercurial - security update","status":"published","published":"2020-07-27T00:00:00Z","modified":"2026-03-09T01:23:33.131746Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0250","title":"Updated mercurial packages fix security vulnerability","description":"It was discovered that Mercurial mishandled symlinks in subrepositories.\nAn attacker could use this vulnerability to write arbitrary files to the\ntarget’s filesystem (CVE-2019-3902).\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T04:43:02.02502389Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2020:0869-1","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-26T12:17:22Z","modified":"2026-02-04T03:29:57.811596Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0880-1","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-27T08:16:39Z","modified":"2026-02-04T03:33:40.600121Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10586-1","title":"mercurial-5.9.1-2.1 on GA media","description":"These are all security issues fixed in the mercurial-5.9.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:48:28.818841Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"PYSEC-2019-188","description":"A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.","status":"published","published":"2019-04-22T16:29:00Z","modified":"2026-06-10T17:01:23.982379761Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2020:1709-1","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).\n","status":"published","published":"2020-06-23T08:32:50Z","modified":"2026-02-04T04:27:33.395947Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1709-2","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).\n","status":"published","published":"2020-07-15T12:33:20Z","modified":"2026-02-04T02:25:38.511009Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:3003-1","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).\n","status":"published","published":"2020-10-22T14:14:59Z","modified":"2026-02-04T03:18:45.537661Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-5102-1","title":"mercurial vulnerabilities","description":"It was discovered that Mercurial mishandled symlinks in subrepositories. An\nattacker could use this issue to write arbitrary files to the\ntarget’s filesystem. (CVE-2019-3902)\n\nIt was discovered that Mercurial incorrectly handled certain manifest files.\nAn attacker could use this issue to cause a denial of service and possibly\nexecute arbitrary code. (CVE-2018-17983)\n\n","status":"published","published":"2021-10-04T17:25:49Z","modified":"2026-02-10T04:42:20Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5102-2","title":"mercurial vulnerabilities","description":"USN-5102-1 fixed vulnerabilities in Mercurial. This update provides the\ncorresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Mercurial mishandled symlinks in subrepositories. An\n attacker could use this issue to write arbitrary files to the\n target’s filesystem. (CVE-2019-3902)\n\n It was discovered that Mercurial incorrectly handled certain manifest files.\n An attacker could use this issue to cause a denial of service and possibly\n execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-17983)\n","status":"published","published":"2021-03-16T20:09:04Z","modified":"2026-06-29T13:49:33.966328831Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}