Apache Subversion SVN authz protected copyfrom paths regression Subversion
servers reveal 'copyfrom' paths that should be hidden according to
configured path-based authorization (authz) rules. When a node has been
copied from a protected location, users with access to the copy can see the
'copyfrom' path of the original. This also reveals the fact that the node
was copied. Only the 'copyfrom' path is revealed; not its contents. Both
httpd and svnserve servers are vulnerable.

Evgeny Kotkov discovered that subversion servers did not properly
follow path-based authorization rules in certain cases. An attacker
could potentially use this issue to retrieve information about
private paths.