CVE-2022-31268

CVE-2022-31268 affects Gitblit 1.9.3 via a path traversal / local file inclusion flaw exposed at the path /resources//../ (e.g., following by WEB-INF or META-INF). The incident enables reading website files on the server. Public sources in connected documents also describe risk of unauthorized fi...

CVE-2022-31267

CVE-2022-31267 affects Gitblit 1.9.2. The issue is privilege escalation via the Config User Service: a control character (for example, in an emailAddress field with a newline/tab) can be interpreted to set role = "#admin". NVD cites CVSSv2/3.1 base scores of 7.5 (HIGH) and 9.8 (CRITICAL). Rationa...

CVE-2025-50978

A reflected cross-site scripting (XSS) vulnerability exists in Gitblit v1.7.1 due to insufficient input sanitization of filename elements during the handling of repository path names. An attacker can inject a specially crafted path payload to cause arbitrary JavaScript execution when a victim vie...

CVE-2025-50977

A template injection vulnerability in Gitblit version 1.7.1 allows authenticated administrators to execute arbitrary client-side code via reflected cross-site scripting (XSS) . The flaw originates from improper handling of the 'r' parameter , where attackers can inject malicious Angular expressio...