CVE-2013-2088: Apache Subversion

High severity, CVSS 7.1. EPSS: 31.5% chance of exploitation in the next 30 days.

contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.

Affected products

• Apache Subversion: up to and including 1.6.21; version 1.6.0 only; version 1.6.1 only; version 1.6.2 only; version 1.6.3 only; version 1.6.4 only; …
• Collabnet Subversion: version 1.6.17 only
• Opensuse Opensuse: version 11.4 only

Published 2013-07-31. Last modified 2026-06-16.