← Vulnerability feed

Vulnerability record · CVE-2008-5916 · published 21 January 2009

CVE-2008-5916: Git permissions and access controls vulnerability

Git · Git

gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.

4.6 CVSS 2.0 Medium EPSS 0.46% · top 62.8% CWE-264 · Permissions and access controls
4.6CVSS 2.0 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
28References
16 Jun 2026Last modified by NVD

Description

gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.

AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://marc.info/?l=git&m=122975564100860&w=2
http://marc.info/?l=linux-kernel&m=122975564100863&w=2:
http://osvdb.org/50918
http://secunia.com/advisories/33282
http://secunia.com/advisories/33964
http://secunia.com/advisories/34194
http://securityreason.com/securityalert/4922
http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
http://www.openwall.com/lists/oss-security/2009/01/15/2
http://www.openwall.com/lists/oss-security/2009/01/20/2
http://www.ubuntu.com/usn/USN-723-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/47528
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01169.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01170.html
http://marc.info/?l=git&m=122975564100860&w=2
http://marc.info/?l=linux-kernel&m=122975564100863&w=2:
http://osvdb.org/50918
http://secunia.com/advisories/33282
http://secunia.com/advisories/33964
http://secunia.com/advisories/34194
http://securityreason.com/securityalert/4922
http://www.gentoo.org/security/en/glsa/glsa-200903-15.xml
http://www.openwall.com/lists/oss-security/2009/01/15/2
http://www.openwall.com/lists/oss-security/2009/01/20/2
http://www.ubuntu.com/usn/USN-723-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/47528
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01169.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01170.html

Track CVE-2008-5916 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-25648Git argument injection vulnerabilityThe package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) fu…EPSS 4.9%9.0CVE-2024-32002Git path traversal vulnerabilityGit is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be c…EPSS 29%7.5CVE-2024-52005Git vulnerabilityGit is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the …EPSS 0.51%7.5CVE-2020-5260Git improper input validation vulnerabilityAffected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git us…EPSS 10%7.5CVE-2008-5516Git os command injection vulnerabilityThe web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary commands via shell metacharacters related to git_se…EPSS 4.4%7.5CVE-2008-5517Git code injection vulnerabilityThe web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) gi…EPSS 12%7.5CVE-2008-3546Git memory buffer overflow vulnerabilityStack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrar…EPSS 4.3%7.5CVE-2006-0477Git vulnerabilityBuffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic li…EPSS 3.3%

Source: NIST National Vulnerability Database (record CVE-2008-5916), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.