Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlist | Gitlist | * | 0.4.0 (including) |
| Gitlist | Gitlist | 0.1 (including) | 0.1 (including) |
| Gitlist | Gitlist | 0.2 (including) | 0.2 (including) |
| Gitlist | Gitlist | 0.3 (including) | 0.3 (including) |