CVE-2026-62960: Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri(), fetchbundleuriinternal(), and copyuritofile() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Git for Windowsto a version that resolves this vulnerability.Fixed in 2.55.0.windows.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Git for Windows installations earlier than 2.55.0.windows.4 are exposed when cloning from or fetching a malicious remote Git server with transfer.bundleuri=true. The server can cause the Windows client to contact an attacker-controlled SMB share.
What does an attacker need to exploit it?
An attacker needs to control, or be able to operate, the remote Git server used for a clone or fetch. No authentication or local privileges are required, but the user must initiate a clone or fetch while bundle URI transfer is enabled.
What can be done if upgrading is not immediately possible?
Avoid cloning from or fetching untrusted Git remotes while transfer.bundleuri=true. Disabling bundle URI use prevents the affected bundle-URI handling path from being used.
How can I determine whether a system is vulnerable?
Check the installed Git for Windows version. Versions prior to 2.55.0.windows.4 are affected; version 2.55.0.windows.4 contains the fix.