What’s Vulnerable › Vulnerabilities

CVE-2018-14912

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 91.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-08-03 · updated 2026-06-17
• Weakness: CWE-22

Description

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.

Affected products

• Cgit Project Cgit: before 1.2.1 — fixed in 1.2.1
• Debian Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: Cgit Project Cgit 1.2.1. Check the vendor advisory for mitigations.

References

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1627
• https://lists.debian.org/debian-lts-announce/2018/08/msg00005.html
• https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html
• https://www.debian.org/security/2018/dsa-4263
• https://www.exploit-db.com/exploits/45195/
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1627
• https://lists.debian.org/debian-lts-announce/2018/08/msg00005.html
• https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html
• https://www.debian.org/security/2018/dsa-4263
• https://www.exploit-db.com/exploits/45195/

Get alerted when CVE-2018-14912 or the next vulnerability affects your stack