CVE-2026-120501

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-120501

An Otter Wiki version 2.20.1 before 2.26.2 is vulnerable to a file disclosure vulnerability within the DataTable embedding. This flaw allows attackers who possess page editing permissions—which may include anonymous users under default configurations—to read internal repository files. By providin...

EUVD-2026-115253

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-120501 An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-120501 An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

PT-2026-135501

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-120501: redimp otterwiki: An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows…

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2025-8110

Gogs RCE Exploit CVE-2025-8110 Proof of Concept for CVE-2025-8110 - Remote Code Execution in Gogs via symlink bypass and sshCommand injection. Description This exploit abuses a symlink bypass in Gogs API to overwrite .git/config and inject malicious sshCommand that executes a reverse shell...

CVE-2022-23642

PoC for Sourcegraph Gitserver 3.37.0 RCE CVE-2022-23642 Sourcegraph prior to 3.37.0 has a remote code execution vulnerability on its gitserver service. This is due to lack of restriction on git config execution thus "core.sshCommand" can be passed on the HTTP arguments which can contain arbitrary...

CVE-2025-65964

n8n Git Hooks CTF Demo ⚠️ This repository is for educational and CTF demonstration purposes only. Scenario An automation platform e.g., n8n uses Git operations as part of a workflow. The workflow allows arbitrary Git configuration via git config. An attacker-controlled workflow sets:...

CVE-2025-8110-Gogs-RCE-Exploit

Gogs CVE-2025-8110 RCE Exploit An automated Python exploit for CVE-2025-8110 in Gogs. This vulnerability allows for Remote Code Execution RCE by abusing the PutContents API, which fails to validate if a file path is a symlink. By overwriting the internal .git/config file via a symlink, we can...

[SECURITY] [DLA 4872-1] python-git security update

Debian LTS Advisory DLA-4872-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias October 31, 2026 https://wiki.debian.org/LTS Package : python-git Version : 3.1.30-1+deb12u3 CVE ID : CVE-2026-42215 CVE-2026-42284 CVE-2026-44243 CVE-2026-44244 CVE-2026-67322...

CVE-2025-8110

CVE-2025-8110 — Gogs RCE PoC Silentium / HackTheBox Disclaimer: This tool is intended strictly for educational purposes and authorized penetration testing. Only use it against systems you have explicit permission to test. This is a modified version of zAbuQasem/gogs-CVE-2025-8110, adapted to work...

CVE-2025-8110

Gogs RCE Exploit CVE-2025-8110 A Proof of Concept PoC for CVE-2025-8110 , a critical vulnerability in Gogs that allows Remote Code Execution RCE via .git/config manipulation using symbolic link bypasses and sshCommand injection. 📖 Overview This exploit targets a Path Traversal flaw in the Gogs AP...

Debian dla-4872 : python-git-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4872 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4872-1 [email protected]...

guardskill

GuardSkill A repository can make your coding agent run code the moment it opens the folder. GuardSkill checks for that before you do. npx guardskill . Read-only. No network calls, no telemetry, no configuration, no account, no dependencies. It reads git configuration and hook scripts, prints what...

CVE-2026-116843

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.59 fail to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives such as core.hooksPath. Attackers can craft config files containing embedded newlines; these become active git directives...

Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.53 fail to properly escape section names in git config files, enabling attackers to inject arbitrary configuration directives via malicious submodule names. Attackers can insert core.sshCommand or other dangerous config keys into the victim’s .git/config using...

CVE-2026-109326 Grav before 2.1.7 Information Disclosure via Nested .git Directories

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructi...