CVE-2017-1000115

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

4.81%

Published

Oct 4, 2017

Modified

May 12, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

Weaknesses (CWE)

CWE-59

Affected Products (13)

mercurial · mercurial (up to 4.3)vulnerable

debian · debian_linuxvulnerable

redhat · enterprise_linux_desktopvulnerable

redhat · enterprise_linux_servervulnerable

redhat · enterprise_linux_server_ausvulnerable

redhat · enterprise_linux_server_eusvulnerable

redhat · enterprise_linux_server_tusvulnerable

redhat · enterprise_linux_workstationvulnerable

References (10)

http://www.debian.org/security/2017/dsa-3963

Third Party Advisory

http://www.securityfocus.com/bid/100290

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:2489

Third Party Advisory

https://security.gentoo.org/glsa/201709-18

Third Party AdvisoryVDB Entry

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29

Release NotesVendor Advisory

http://www.debian.org/security/2017/dsa-3963

Third Party Advisory

http://www.securityfocus.com/bid/100290

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:2489

Third Party Advisory

https://security.gentoo.org/glsa/201709-18

Third Party AdvisoryVDB Entry

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29

Release NotesVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs