CVE-2024-4981CWE-552
Pagure: _update_file_in_git() follows symbolic links in temporary clones
High · published May 12, 2025
What it is
A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.
The record
Technical detail
- CVSS v3.1
- 7.6 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.00425 · 35.7th percentile
- Weakness
- CWE-552 · Files or Directories Accessible to External Parties
- Published
- 2025-05-12T18:55Z
EPSS history
Timeline