Skip to content

CVE-2025-68145: Verified Repro With Script Download

CVE-2025-68145: MCP Server Git: Path Traversal via Missing Repository Path Validation

Download script Open in Codespaces

CVE-2025-68145 is verified against mcp-server-git · pip. Affected versions: < 2025.12.18. Fixed in 2025.12.18. Vulnerability class: Path Traversal. This critical reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00076.

REPRO-2026-00076 mcp-server-git · pip Path Traversal Jan 21, 2026 CVE entry ↗ .txt
Severity
CRITICAL
CVSS
9.1
Reproduced in
11m 29s
Tool calls
155
01 · Overview

What Is CVE-2025-68145?

CVE-2025-68145 (GHSA-j22h-9j4x-23w5) is a medium-severity path traversal vulnerability in mcp-server-git, where the server fails to validate that repo_path arguments stay within the repository configured by the --repository flag. Pruva reproduced it (reproduction REPRO-2026-00076).

02 · Severity & CVSS

CVE-2025-68145 Severity & CVSS Score

CVE-2025-68145 is rated critical severity, with a CVSS base score of 9.1 out of 10.

CRITICAL threat level
9.1 / 10 CVSS base
Weakness CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Critical — the most severe class — typically remotely exploitable with severe impact. Treat as an emergency.

03 · Affected Versions

Affected mcp-server-git Versions

mcp-server-git · pip versions < 2025.12.18 are affected.

05 · How to Reproduce
Download script Open in Codespaces →

How to Reproduce CVE-2025-68145

$ pruva-verify REPRO-2026-00076
or curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00076/artifacts/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh
Run in a VM or disposable container. This exploits a real vulnerability.
06 · Proof of Reproduction

Proof of Reproduction for CVE-2025-68145

Reproduced by Pruva's autonomous agents — 155 tool calls over 11 min. Full root-cause analysis and the complete transcript are below.

How the agent worked 224 events · 155 tool calls · 11 min
11 minDuration
155Tool calls
65Reasoning steps
224Events
Agent activity over 11 min
Support
1
Repro
219
0:0011:29

Root Cause and Exploit Chain for CVE-2025-68145

Summary

mcp-server-git versions prior to 2025.12.18 do not validate that the repo_path argument supplied to tool calls remains within the repository configured by the --repository flag. As a result, a client can call tools (e.g., git_status) against any other Git repository accessible to the server process, defeating the intended restriction.

Impact

  • Affected component: mcp-server-git Python package (stdio MCP server)
  • Affected versions: < 2025.12.18 (reproduced with 2025.11.25)
  • Risk level: Medium
  • Consequence: Clients can read or manipulate repositories outside the configured allowed repository, including via path traversal or symlink escapes.

Root Cause

The vulnerable server implementation directly converts repo_path from tool call arguments into a Path and opens it with git.Repo(...) without checking whether it is inside the configured --repository path. The fix (2025.12.18) introduces validate_repo_path, which resolves both the allowed repository and requested path (following symlinks) and rejects paths outside the allowed root before executing Git operations.

Reproduction Steps

  1. Run repro/reproduction_steps.sh.
  2. The script creates two Git repositories, starts the vulnerable server (2025.11.25) with --repository set to the allowed repo, and calls git_status against outside paths (direct, traversal, and symlink).
  3. The script repeats the call against the fixed server (2025.12.18) and confirms rejection.

Evidence

  • Vulnerable behavior (access outside repo succeeds):
    • logs/vuln_outside_repo.log (shows isError False with status output for the outside repo)
    • logs/vuln_traversal_repo.log
    • logs/vuln_symlink_repo.log
  • Fixed behavior (access outside repo blocked):
    • logs/fixed_outside_repo.log
    • logs/fixed_symlink_repo.log
  • Environment: Python 3.11 with venvs created by the script, Git CLI used to initialize test repos.

Recommendations / Next Steps

  • Upgrade mcp-server-git to 2025.12.18 or later.
  • Ensure all tool entry points validate repository paths using resolved paths (including symlinks) before performing Git operations.
  • Add regression tests covering path traversal and symlink escape cases.

Additional Notes

  • repro/reproduction_steps.sh was executed twice successfully to verify idempotence.
  • The test covers direct path usage, relative traversal, and symlink escapes to match the fixed validation logic.

CVE-2025-68145 Reproduction Transcript

The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired.

Full session Replay every step — scrub the timeline or play it back.

Event 1/40
0:001:05
0:00
session startedgpt-5-codex · ghsa-j22h-9j4x-23w5 · a350f3af
0:10
extract_facts
output{"stored": true, "fact_count": 2}
0:10
supportrepro
0:10
supportrepro
0:12
0:12
0:13
0:13
0:15
0:15
0:15
0:20
0:20
$ls -la
✓
total 27
drwxr-xr-x 6 root root 4096 Jan 21 07:32 .
drwxr-xr-x 4 root root 4096 Jan 21 07:32 ..
drwxr-xr-x 3 root root 4096 Jan 21 07:32 artifacts
drwxr-xr-x 2 root root 4096 Jan 21 07:32 coding
-rw-r--r-- 1 root root  635 Jan 21 07:32 handoffs.jsonl
drwxr-xr-x 2 root root 4096 Jan 21 07:32 logs
drwxr-xr-x 2 root root 4096 Jan 21 07:32 repro
0:20
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 27\\ndrwxr-xr-x 6 root root 4096 Jan 21 07:32 .\\ndrwxr-xr-x 4 root root 4096 Jan 21 07:32 ..\\ndrwxr-xr-x 3 root root 4096 Jan 21 07:32 artifacts\\ndrwxr-xr-x 2 root ro"}
0:24
$cat ticket.md
✓
# GHSA-j22h-9j4x-23w5: mcp-server-git has missing path validation when using --repository flag

## Description
In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could allow tool calls to operate on other repositories accessible to the server process. The fix adds path validation that resolves both the configured repository and the requested path (following symlinks) and verifies the requested path is within the allowed repository before executing any git operations. Users are advised to upgrade to 2025.12.18 to remediate this issue.

Thank you to https://hackerone.com/yardenporat for reporting.

## Severity
0:24
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"# GHSA-j22h-9j4x-23w5: mcp-server-git has missing path validation when using --repository flag\\n\\n## Description\\nIn mcp-server-git versions prior to 2025.12.18, when the "}
0:27
0:27
$ls -la artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo
✓
ls: cannot access 'artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo': No such file or directory
0:27
$
✓
{"output":"{\"returncode\": 2, \"stdout\": \"\", \"stderr\": \"ls: cannot access 'artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo': No such file or directory\\n\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-j22h-"}
0:30
0:30
$ls -la /home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236
✓
total 21
drwxr-xr-x 4 root root 4096 Jan 21 07:32 .
drwxr-xr-x 4 root root 4096 Jan 21 07:32 ..
drwxr-xr-x 6 root root 4096 Jan 21 07:32 ghsa-j22h-9j4x-23w5
drwxr-xr-x 2 root root 4096 Jan 21 07:32 repo
-rw-r--r-- 1 root root  523 Jan 21 07:32 trace.json
-rw-r--r-- 1 root root 3705 Jan 21 07:33 trace_spans.jsonl
0:30
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 21\\ndrwxr-xr-x 4 root root 4096 Jan 21 07:32 .\\ndrwxr-xr-x 4 root root 4096 Jan 21 07:32 ..\\ndrwxr-xr-x 6 root root 4096 Jan 21 07:32 ghsa-j22h-9j4x-23w5\\ndrwxr-xr-x"}
0:34
0:35
$ls -la /home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo
✓
total 8
drwxr-xr-x 2 root root 4096 Jan 21 07:32 .
drwxr-xr-x 4 root root 4096 Jan 21 07:32 ..
0:35
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 8\\ndrwxr-xr-x 2 root root 4096 Jan 21 07:32 .\\ndrwxr-xr-x 4 root root 4096 Jan 21 07:32 ..\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-2"}
0:37
0:37
$ls -la /home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/ghsa-j22h-9j4x-23w5/artifacts/prepped
✓
total 8
drwxr-xr-x 2 root root 4096 Jan 21 07:32 .
drwxr-xr-x 3 root root 4096 Jan 21 07:32 ..
0:37
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 8\\ndrwxr-xr-x 2 root root 4096 Jan 21 07:32 .\\ndrwxr-xr-x 3 root root 4096 Jan 21 07:32 ..\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-2"}
0:39
0:39
$git --version
✓
git version 2.43.0
0:39
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"git version 2.43.0\\n\", \"stderr\": \"\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/ghsa-j22h-9j4x-23w5\"}"}
0:43
0:59
$git clone https://github.com/modelcontextprotocol/servers /home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo
16.0s✓
Cloning into '/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo'...
0:59
$
16.0s✓
{"output":"{\"returncode\": 0, \"stdout\": \"\", \"stderr\": \"Cloning into '/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo'...\\n\", \"cwd\": \"/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20"}
1:02
1:02
$ls -la /home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo
✓
total 528
drwxr-xr-x 6 root root   4096 Jan 21 07:33 .
drwxr-xr-x 4 root root   4096 Jan 21 07:32 ..
drwxr-xr-x 8 root root   4096 Jan 21 07:33 .git
-rw-r--r-- 1 root root     42 Jan 21 07:33 .gitattributes
drwxr-xr-x 3 root root   4096 Jan 21 07:33 .github
-rw-r--r-- 1 root root   5306 Jan 21 07:33 .gitignore
-rw-r--r-- 1 root root    123 Jan 21 07:33 .mcp.json
1:02
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"total 528\\ndrwxr-xr-x 6 root root   4096 Jan 21 07:33 .\\ndrwxr-xr-x 4 root root   4096 Jan 21 07:32 ..\\ndrwxr-xr-x 8 root root   4096 Jan 21 07:33 .git\\n-rw-r--r-- 1 root "}
1:04
1:05
$grep -R "mcp-server-git" -n /home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src | head -n 20
✓
/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src/git/README.md:1:# mcp-server-git: A git MCP server
/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src/git/README.md:9:Please note that mcp-server-git is currently in early development. The functionality and available tools are subject to change and expansion as we continue to develop and improve the server.
/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src/git/README.md:104:use [`uvx`](https://docs.astral.sh/uv/guides/tools/) to directly run *mcp-server-git*.
/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src/git/README.md:108:Alternatively you can install `mcp-server-git` via pip:
/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src/git/README.md:111:pip install mcp-server-git
/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src/git/README.md:133:    "args": ["mcp-server-git", "--repository", "path/to/git/repo"]
/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src/git/README.md:171:[![Install with UV in VS Code](https://img.shields.io/badge/VS_Code-UV-0098F… [truncated]
1:05
$
✓
{"output":"{\"returncode\": 0, \"stdout\": \"/home/user/pruva/artifacts/runs/ghsa-j22h-9j4x-23w5/20260121-073236/repo/src/git/README.md:1:# mcp-server-git: A git MCP server\\n/home/user/pruva/artifacts/runs/ghsa-j22h-"}

Artifacts and Evidence for CVE-2025-68145

Scripts, logs, diffs, and output captured during the reproduction.

No artifacts available
08 · How to Fix

How to Fix CVE-2025-68145

Upgrade mcp-server-git · pip to 2025.12.18 or later.

Coming soon

Step-by-step mitigation and hardening guidance for CVE-2025-68145 — configuration checks, workarounds where no patch exists, and how to verify you're protected — is on the way.

10 · FAQ

FAQ: CVE-2025-68145

How does the CVE-2025-68145 path-traversal attack work?

A client calls a tool such as git_status and supplies a repo_path pointing outside the allowed repository — via a direct absolute path, a traversal sequence, or a symlink — and the server opens and operates on that other Git repository, defeating the intended --repository restriction and exposing repositories the client shouldn't have access to.

Which mcp-server-git versions are affected by CVE-2025-68145, and where is it fixed?

Versions before 2025.12.18 are affected (reproduced with 2025.11.25). It is fixed in 2025.12.18, which introduces validate_repo_path to resolve both the allowed repository and the requested path (following symlinks) and reject paths outside the allowed root before executing Git operations.

How severe is CVE-2025-68145?

It is rated medium severity. Clients can read or manipulate Git repositories outside the configured allowed repository, including via path traversal or symlink escapes.

How can I reproduce CVE-2025-68145?

Download the verified script from this page and run it in an isolated environment against mcp-server-git 2025.11.25. It creates two Git repositories, starts the server with --repository set to the allowed repo, and calls git_status against the other repo via a direct path, path traversal, and a symlink, showing all three succeed; it then repeats the calls against the fixed 2025.12.18 server and confirms they are rejected.
11 · References

References for CVE-2025-68145

Authoritative sources for CVE-2025-68145 — official vulnerability databases and the upstream advisory. Pruva's reproduction verifies the issue firsthand; these are the primary records to corroborate it.