Cgit is a lightweight web interface for Git repositories that, despite a narrow product footprint, is widely deployed in self-hosted development and infrastructure environments. Its disclosed vulnerabilities center on the web-facing attack surface, with recurring weaknesses in path traversal and memory-safety handling that reflect the parsing demands of a network-exposed CGI application. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cgit Project over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-14912HIGH cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=. | Aug 3, 2018 | 7.5 | 91 | NO | YES |
CVE-2016-1901CRITICAL Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which | Jan 20, 2016 | 9.8 | 31 | NO | NO |
CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cros | Jan 20, 2016 | 3.7 | 18 | NO | NO |
CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject a | Jan 20, 2016 | 3.7 | 13 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cgit Project.
Media articles that mention a CVE ID that affects a product developed by Cgit Project — matched by CVE ID, not by vendor name.