Description
Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 allows remote attackers to execute arbitrary commands via .. (dot dot) sequences in admin-defined commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | gitolite | 1.5.4-2+squeeze1 | DSA-2215-1 |
Advisories 1
- DSA-2215-1 gitolite - directory traversal Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://groups.google.com/group/gitolite/browse_thread/thread/797a93ec26e1dcbc?pli=1
- [oss-security] 20110411 Re: CVE id request: gitolite mailing-list
- https://github.com/sitaramc/gitolite/commit/4ce00aef84d1ff7c35f7adbbb99a6241cfda00cc
- DSA-2215 vendor-advisory
- [oss-security] 20110409 CVE id request: gitolite mailing-list
- 46473 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=695568
- gitolite-adc-security-bypass(65542) vdb-entry