CVE-2013-2088

Subversion < 1.6.23 - Authenticated Remote Code Execution via Shell Metacharacters in Filename

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-2088. PoCs published by GlacierZ0ne.

AI-analyzed exploit summary This exploit leverages a vulnerability in the `svn-keyword-check.pl` pre-commit hook script (CVE-2013-2088) to achieve remote code execution on a Subversion server. It requires a misconfigured hook script and authenticated access with commit privileges.

Description

contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.

Exploits (1)

exploitdb WORKING POC

by GlacierZ0ne · pythonremotelinux

https://www.exploit-db.com/exploits/40507

View Code ZIP pw:eip

This exploit leverages a vulnerability in the `svn-keyword-check.pl` pre-commit hook script (CVE-2013-2088) to achieve remote code execution on a Subversion server. It requires a misconfigured hook script and authenticated access with commit privileges.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Subversion (svn-keyword-check.pl before 1.6.23)

Auth required

Prerequisites: Subversion server with WebDAV via Apache · Pre-commit hook configured with vulnerable `svn-keyword-check.pl` · Authenticated user with commit privileges · Subversion client installed

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 16, 2026 Full analysis →