Remote Server Manipulation Vulnerability in Git for Windows

CVE-2026-62960

What is CVE-2026-62960?

A vulnerability in Git for Windows allows a malicious remote Git server to exploit the application during clone or fetch operations. By advertising a bundle URI, it can trigger the functions transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() within bundle-uri.c. If configured to allow transfer.bundleuri, this causes the application to treat non-HTTP(S) values as local filesystem paths, leading to an outbound SMB connection via a bare UNC path or file URI to an attacker-controlled share. This may result in unauthorized exposure of NTLM authentication credentials to the attacker's host. The issue is resolved in version 2.55.0.windows.4.

References