Description
plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATH_INFO.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | gforge-plugin-scmcvs | 4.5.14-5etch1 | DSA-1297-1 |
Advisories 1
- DSA-1297-1 gforge-plugin-scmcvs Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://gforge.org/scm/viewvc.php/branches/Branch_4_5/gforge/plugins/scmcvs/www/cvsweb.php?root=gforge&r1=5849&r2=6038&pathrev=6038
- ADV-2007-1942 vdb-entry
- gforge-cvsweb-command-execution(34510) vdb-entry
- 36526 vdb-entry
- DSA-1297 vendor-advisory
- 25395 third-party-advisory
- 25416 third-party-advisory
- 24141 vdb-entry