CVE-2024-46901

What it actually does

Insufficient validation of filenames against control characters allows authenticated users with commit access to introduce corrupted revisions via mod_dav_svn.

Why it matters to the business

Disrupts development teams relying on Subversion repositories served over HTTP, leading to repository access issues, lost productivity, and potential recovery work; widespread use of Subversion increases exposure scope.

How an attack unfolds

An attacker with commit privileges to a mod_dav_svn-exposed repository crafts a commit containing filenames with control characters; the server accepts the commit without validation, corrupting the revision and impacting all subsequent users of the repository.

How to fix it

Upgrade Apache Subversion to version 1.14.5 or apply the patch from commit c828a37af875249916a452481cae96df83dc67ea; repositories accessed via methods other than mod_dav_svn require no action.

How to confirm the fix worked

Confirm Subversion version is at least 1.14.5; test by attempting a commit with control-character filenames and verify the revision is rejected or handled safely.

Typical attack path

1. Obtain commit access to a target Subversion repository
2. Confirm exposure via mod_dav_svn
3. Craft and submit a commit using filenames containing control characters
4. Observe resulting repository corruption and disruption

How to detect it

Inspect Subversion revision logs and error messages for filenames containing non-printable control characters; monitor for unusual commit failures or checkout errors across affected repositories.

What your security team should do

• Immediately upgrade all mod_dav_svn deployments to Subversion 1.14.5
• Review and restrict commit privileges on exposed repositories
• Scan revision history for evidence of prior corruption attempts