Mercurial Directory traversal vulnerability
Date: 2022-05
Affected: pip/mercurial
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2008-2942
CWE: CWE-22

Directory traversal vulnerability in patch.py in Mercurial before 1.0.2 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.


Mitigations:

Architectural layers (MAESTRO):