CVE-2018-14912
HIGH EXPLOITED NUCLEICGit <1.2.1 - Path Traversal
Title source: llmDescription
cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
Exploits (2)
metasploit
WORKING POC
by Google Project Zero, Dhiraj Mishra · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/cgit_traversal.rb
Nuclei Templates (1)
cgit < 1.2.1 - Directory Traversal
HIGHby 0x_Akoko
Shodan:
http.title:"git repository browser"
FOFA:
title="git repository browser"
References (5)
Scores
CVSS v3
7.5
EPSS
0.9147
EPSS Percentile
99.7%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
VulnCheck KEV
2023-11-26
CWE
CWE-22
Status
published
Products (3)
cgit_project/cgit
< 1.2.1
debian/debian_linux
8.0
debian/debian_linux
9.0
Published
Aug 03, 2018
Tracked Since
Feb 18, 2026