CVE-2024-4981: Pagure: _update_file_in_git() follows symbolic links in temporary clones

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-12 · updated 2026-06-17
Weakness: CWE-552

Description

A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.

Affected products

Pagure Project Pagure: before 5.14.1 — fixed in 5.14.1

How to fix

Upgrade to a fixed version: Pagure Project Pagure 5.14.1. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2024-4981
https://bugzilla.redhat.com/show_bug.cgi?id=2278745
https://bugzilla.redhat.com/show_bug.cgi?id=2280723
https://pagure.io/pagure/c/454f2677bc50d7176f07da9784882eb2176537f4

Get alerted when CVE-2024-4981 or the next vulnerability affects your stack