CVE-2024-4981
published 2025-05-12CVE-2024-4981: A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show…
PriorityP336high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
EPSS
0.35%
27.1th percentile
A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pagure | < pagure 5.11.3+dfsg-1+deb11u1 (bullseye) | pagure 5.11.3+dfsg-1+deb11u1 (bullseye) |
| redhat | pagure | < 5.14.1 | 5.14.1 |
| redhat | pagure | >= 0 < 5.11.3+dfsg-1+deb11u1 | 5.11.3+dfsg-1+deb11u1 |
| redhat | pagure | >= 0 < 5.14.1+dfsg-1 | 5.14.1+dfsg-1 |
| redhat | pagure | >= 0 < 5.11.3+dfsg-1ubuntu0.1 | 5.11.3+dfsg-1ubuntu0.1 |
| redhat | pagure | >= 0 < 5.11.3+dfsg-2.1ubuntu0.2 | 5.11.3+dfsg-2.1ubuntu0.2 |
| redhat | pagure | >= 0 < 5.8.1+dfsg-3ubuntu0.1~esm1 | 5.8.1+dfsg-3ubuntu0.1~esm1 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
osv8.1HIGH
vendor_ubuntu8.1HIGH
vendor_debian7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Pagure vulnerabilities
vendor_ubuntu·2026-01-29·CVSS 8.1
CVE-2024-4981 [HIGH] Pagure vulnerabilities
Title: Pagure vulnerabilities
Summary: Several security issues were fixed in Pagure.
Thomas Chauchefoin discovered that Pagure incorrectly handled symbolic
links in Git repositories. A remote attacker could possibly use this
issue to cause Pagure to expose files outside the intended repository
boundaries. (CVE-2024-4981)
Thomas Chauchefoin discovered that Pagure did not properly sanitize path
inputs. A remote attacker could possibly use this issue to read arbitrary
files. (CVE-2024-4982)
Thomas Chauchefoin discovered that Pagure incorrectly handled symbolic
links during repository archiving. A remote attacker could possibly use
this issue to disclose local files on the server. (CVE-2024-47515)
Thomas Chauchefoin discovered that Pagure incorrectly handled certain
inputs. A remote attac
Debian
CVE-2024-4981: pagure - A vulnerability was discovered in Pagure server. If a malicious user were to sub...
vendor_debian·2024·CVSS 7.6
CVE-2024-4981 [HIGH] CVE-2024-4981: pagure - A vulnerability was discovered in Pagure server. If a malicious user were to sub...
A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.
Scope: local
bullseye: resolved (fixed in 5.11.3+dfsg-1+deb11u1)
sid: resolved (fixed in 5.14.1+dfsg-1)
trixie: resolved (fixed in 5.14.1+dfsg-1)
OSV
pagure vulnerabilities
osv·2026-01-29·CVSS 8.1
CVE-2024-4981 [HIGH] pagure vulnerabilities
pagure vulnerabilities
Thomas Chauchefoin discovered that Pagure incorrectly handled symbolic
links in Git repositories. A remote attacker could possibly use this
issue to cause Pagure to expose files outside the intended repository
boundaries. (CVE-2024-4981)
Thomas Chauchefoin discovered that Pagure did not properly sanitize path
inputs. A remote attacker could possibly use this issue to read arbitrary
files. (CVE-2024-4982)
Thomas Chauchefoin discovered that Pagure incorrectly handled symbolic
links during repository archiving. A remote attacker could possibly use
this issue to disclose local files on the server. (CVE-2024-47515)
Thomas Chauchefoin discovered that Pagure incorrectly handled certain
inputs. A remote attacker could possibly use this issue to execute
arbitrary code on
GHSA
GHSA-vw7p-rwg9-7mrq: A vulnerability was discovered in Pagure server
ghsa_unreviewed·2025-05-12
CVE-2024-4981 [HIGH] CWE-552 GHSA-vw7p-rwg9-7mrq: A vulnerability was discovered in Pagure server
A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.
OSV
CVE-2024-4981: A vulnerability was discovered in Pagure server
osv·2025-05-12·CVSS 7.1
CVE-2024-4981 [HIGH] CVE-2024-4981: A vulnerability was discovered in Pagure server
A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-12
Published