CVE-2012-6114: The git-changelog utility in git-extras 1.7.0 allows local users to overwrite arbitrary files via a symlink...

Security readout for executives and security teams

CVE-2012-6114 affects git-extras 1.7.0. Its git-changelog utility used predictable temporary paths, allowing a local user to redirect output through a symlink and overwrite files writable by the victim process. This is mainly a multi-user or privileged-automation risk, not a remote internet exposure based on the supplied sources. Exposure is most likely on systems with git-extras 1.7.0 installed, especially shared Unix-like hosts or automation that runs git-changelog with elevated privileges. Internet-facing services are not indicated as directly exposed by the supplied sources. Treat this as a targeted local privilege and integrity risk. Prioritize shared developer systems, build hosts, and any automation running git-extras with elevated permissions. It is not presented as a broad remote compromise issue in the supplied evidence. Mitigation focus: Inventory systems for git-extras 1.7.0 installations.; Check vendor or distribution guidance for a fixed git-extras package.; Upgrade git-extras from a trusted package source when a fix is available..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.