cgit < 1.2.1 cgit_clone_objects() Directory Traversal

Risk: Medium
Local: No
Remote: Yes

There is a directory traversal vulnerability in cgit_clone_objects(), reachable when the configuration flag enable-http-clone is set to 1 (default): void cgit_clone_objects(void) { if (!ctx.qry.path) { cgit_print_error_page(400, "Bad request", "Bad request"); return; } if (!strcmp(ctx.qry.path, "info/packs")) { print_pack_info(); return; } send_file(git_path("objects/%s", ctx.qry.path)); } send_file() is a function that simply sends the data stored at the given filesystem path out over the network. git_path() partially rewrites the provided path and e.g. prepends the base path of the repository, but it does not sanitize the provided path to prevent directory traversal. ctx.qry.path can come from querystring_cb(), which takes unescaped data from the querystring. To trigger this case: $ curl root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018,


Back to Top