CVE-2024-4981
Pagure: _update_file_in_git() follows symbolic links in temporary clones
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Pagure: _update_file_in_git() follows symbolic links in temporary clones
A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.
Reserved 2024-05-15 | Published 2025-05-12 | Updated 2025-05-12 | Assigner fedoraFiles or Directories Accessible to External Parties
| 2024-05-15: | Reported to Red Hat. |
| 2024-05-03: | Made public. |
access.redhat.com/security/cve/CVE-2024-4981
bugzilla.redhat.com/show_bug.cgi?id=2278745
bugzilla.redhat.com/show_bug.cgi?id=2280723 (RHBZ#2280723)
pagure.io/pagure/c/454f2677bc50d7176f07da9784882eb2176537f4
Support options
