Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2024-4981

Pagure: _update_file_in_git() follows symbolic links in temporary clones

Description

A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pagure

Default version status: unaffected

  • 0 to < 5.14.1affected

References