CVE-2013-2088

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 31.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-07-31 · updated 2026-06-16
Weakness: CWE-20

Description

contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.

Affected products

Apache Software Foundation Apache Subversion: through 1.6.21; 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.6.5 (+15)
Collabnet Subversion: 1.6.17
Opensuse: 11.4

References

http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html
http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E
http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18772
https://subversion.apache.org/security/CVE-2013-2088-advisory.txt
https://www.exploit-db.com/exploits/40507/
http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html
http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvRK51pQsybfvsAzjxQJrmVpL0fEa1K4WGkUP9Tzz6KFDw%40mail.gmail.com%3E
http://mail-archives.apache.org/mod_mbox/subversion-announce/201305.mbox/%3CCADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8%2BxbHA5tocrrewWew%40mail.gmail.com%3E
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18772
https://subversion.apache.org/security/CVE-2013-2088-advisory.txt
https://www.exploit-db.com/exploits/40507/

Get alerted when CVE-2013-2088 or the next vulnerability affects your stack