https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T04:24:20.702027+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-4981 CVE-2024-4981 — Pagure: _update_file_in_git() follows symbolic links in temporary clones 2026-09-29T04:24:20.703687+00:00

Affected: pagure

A vulnerability was discovered in Pagure server. If a malicious user were to submit a git repository with symbolic links, the server could unintentionally show incorporate and make visible content from outside the git repo.

 https://vulnerability.circl.lu/vuln/usn-7984-1 USN-7984-1 — pagure vulnerabilities 2026-09-29T04:24:20.703769+00:00

Affected: Ubuntu:Pro:20.04:LTS: pagure, Ubuntu:22.04:LTS: pagure, Ubuntu:24.04:LTS: pagure

Thomas Chauchefoin discovered that Pagure incorrectly handled symbolic links in Git repositories. A remote attacker could possibly use this issue to cause Pagure to expose files outside the intended repository boundaries. (CVE-2024-4981)

Thomas Chauchefoin discovered that Pagure did not properly sanitize path inputs. A remote attacker could possibly use this issue to read arbitrary files. (CVE-2024-4982)

Thomas Chauchefoin discovered that Pagure incorrectly handled symbolic links during repository archiving. A remote attacker could possibly use this issue to disclose local files on the server. (CVE-2024-47515)

Thomas Chauchefoin discovered that Pagure incorrectly handled certain inputs. A remote attacker could possibly use this issue to execute arbitrary code on the server. (CVE-2024-47516)