Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.
All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue.
Repositories served via other access methods are not affected.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade subversion | Aug 8, 2025 | Dec 9, 2024 |
| Debian | — | Upgrade subversion | Mar 17, 2025 | Dec 9, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade subversionUpgrade subversion-help | Mar 18, 2025 | Dec 9, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade subversion-helpUpgrade subversion | Feb 11, 2025 | Dec 9, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade subversion-helpUpgrade subversion | Feb 11, 2025 | Dec 9, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade subversion-helpUpgrade subversion | Mar 18, 2025 | Dec 9, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 9, 2024 |
| Suse | — | Upgrade libsvn_auth_gnome_keyring-1-0Upgrade subversion-bash-completionUpgrade subversionUpgrade subversion-serverUpgrade subversion-develUpgrade libsvn_auth_kwallet-1-0Upgrade subversion-rubyUpgrade subversion-perlUpgrade subversion-pythonUpgrade subversion-tools | Dec 5, 2025 | Dec 17, 2024 |
| Ubuntu | — | Upgrade subversion (Ubuntu Pro) | Oct 14, 2025 | Dec 9, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Dec 9, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub