Unrated severityNVD Advisory· Published Jul 22, 2014· Updated Jun 17, 2026

CVE-2014-4511

Description

Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Gitlist/Gitlist5 versions
cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*range: <=0.4.0
- cpe:2.3:a:gitlist:gitlist:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:gitlist:gitlist:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:gitlist:gitlist:0.3:*:*:*:*:*:*:*
- (no CPE)range: <0.5.0

Patches

Vulnerability mechanics

References

hatriot.github.io/blog/2014/06/29/gitlist-rce/nvdExploit
packetstormsecurity.com/files/127281/Gitlist-0.4.0-Remote-Code-Execution.htmlnvdExploit
packetstormsecurity.com/files/127364/Gitlist-Unauthenticated-Remote-Command-Execution.htmlnvdExploit
www.exploit-db.com/exploits/33929nvdExploit
www.exploit-db.com/exploits/33990nvdExploit
groups.google.com/forum/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.066
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000