CVE-2022-31012

HIGH 7.3CVE-2022-31012 · Published 12/07/2022 · updated 17/06/2026

In short

CVE-2022-31012 is a HIGH (CVSS 7.3) vulnerability affecting git (gitforwindows).
Chance of exploitation in the next 30 days (EPSS): 0.39%, higher than 33.6% of all vulnerabilities.
Fix: update to 2.37.1 or later.

Package	Affected versions	Patched versions
git gitforwindows	`< 2.37.1`	`2.37.1`

Description

Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when upgrading Git for Windows. A patch is included in version 2.37.1. Two workarounds are available. Create the `C:\mingw64` folder and remove read/write access from this folder, or disallow arbitrary authenticated users to create folders in `C:\`.

References

git-for-windows/git release v2.37.1.windows.1 · Release Notes
git-for-windows/git security advisory · Mitigation

More vulnerabilities in git

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

git

gitforwindows

< 2.37.1

2.37.1

Description

More vulnerabilities in git

See all →