CVE-2021-47874
Published: 21 January 2026
Summary
CVE-2021-47874 is a high-severity Unquoted Search Path or Element (CWE-428) vulnerability in Vfsforgit (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception by Unquoted Path (T1574.009); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-2 (Baseline Configuration) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2021-47874 is an unquoted service path vulnerability (CWE-428) in VFS for Git version 1.0.21014.1, affecting the GVFS.Service Windows service. The issue stems from an unquoted binary path in the service configuration, which allows local attackers to execute arbitrary code with elevated privileges by injecting malicious executables into the system's search path.
A local attacker with low privileges (AV:L/AC:L/PR:L) can exploit this vulnerability by placing a malicious executable in a directory that precedes the legitimate service binary in the Windows PATH environment. Upon GVFS.Service startup or system reboot, the malicious binary executes with LocalSystem privileges, granting high impacts on confidentiality, integrity, and availability (CVSS:3.1 score of 7.8; C:H/I:H/A:H).
Advisories and references include the official VFS for Git site (https://vfsforgit.org/), a VulnCheck advisory on the GVFS.Service unquoted path issue (https://www.vulncheck.com/advisories/vfs-for-git-gvfsservice-unquoted-service-path), and a public exploit on Exploit-DB (https://www.exploit-db.com/exploits/49661), highlighting the need for patching or service reconfiguration to mitigate local privilege escalation risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3627
Vulnerability details
VFS for Git 1.0.21014.1 contains an unquoted service path vulnerability in the GVFS.Service Windows service that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched…
more
with LocalSystem privileges during service startup or system reboot.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unquoted service path in GVFS.Service directly enables path interception by unquoted path (T1574.009) for local privilege escalation (T1068) via malicious executable placement in PATH.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates identification, reporting, and correction of flaws like unquoted service paths via patching or reconfiguration, directly preventing exploitation of CVE-2021-47874.
CM-6 requires establishing and enforcing secure configuration settings for system components, including quoted binary paths for services to block PATH hijacking.
CM-2 ensures a secure baseline configuration is developed and maintained, incorporating proper service path quoting to mitigate unquoted path vulnerabilities.