High severity7.5NVD Advisory· Published Aug 3, 2018· Updated Jun 17, 2026

CVE-2018-14912

Description

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when enable-http-clone=1 is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Lars Hjemli/Cgit2 versions
cpe:2.3:a:cgit_project:cgit:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:cgit_project:cgit:*:*:*:*:*:*:*:*range: <1.2.1
- (no CPE)range: <1.2.1
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
osv-coords
pkg:rpm/opensuse/cgit&distro=openSUSE%20Tumbleweed
Range: < 1.2.3-1.10

Patches

Vulnerability mechanics

References

bugs.chromium.org/p/project-zero/issues/detailnvdExploitIssue TrackingThird Party Advisory
www.exploit-db.com/exploits/45195/nvdExploitThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2018/08/msg00005.htmlnvdThird Party Advisory
www.debian.org/security/2018/dsa-4263nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.074
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000