CVE-2024-4981

Published: May 12, 2025Modified: Aug 7, 2025

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Exploitability: 2.8 / Impact: 4.2

Source: NVD

Description

A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.

Affected (1)

Products: Redhat: Pagure

Redhat

1 product

Pagure

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Pagure	Before 5.14.1

Related CWEs

CWE-552

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (4)

https://access.redhat.com/security/cve/CVE-2024-4981

Source: patrick@puiterwijk.org

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2278745

Source: patrick@puiterwijk.org

Permissions Required

https://bugzilla.redhat.com/show_bug.cgi?id=2280723

Source: patrick@puiterwijk.org

ExploitIssue Tracking

https://pagure.io/pagure/c/454f2677bc50d7176f07da9784882eb2176537f4

Source: patrick@puiterwijk.org

Patch

Timeline

No history available yet.