Description
Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cgit | 1.0-1.3 | openSUSE-SU-2024:10137-1 |
Advisories 1
- openSUSE-SU-2024:10137-1 cgit-1.0-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 54186 third-party-advisory
- http://git.zx2c4.com/cgit/commit/?h=wip&id=babf94e04e74123eb658a823213c062663cdadd6
- openSUSE-SU-2013:1303 vendor-advisory
- [oss-security] 20130527 Re: CVE Request: cgit directory traversal mailing-list
- [CGit] 20130527 [ANNOUNCE] CGIT v0.9.2 Released mailing-list
- openSUSE-SU-2013:1207 vendor-advisory