CVE-2014-4511: Gitlist unauthenticated command injection via URI file name

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with public exploits and very high EPSS probability makes this an urgent patch target.

What it is

Gitlist before 0.5.0 passes the file name from the request URI into a shell command without sanitizing shell metacharacters, allowing remote command execution on the blame, file, and stats pages. Because the flaw is reachable without authentication, any network user who can reach the Gitlist instance can run arbitrary commands as the web server user.

Impact

An attacker gains arbitrary command execution on the host running Gitlist, which can lead to reading repository contents, stealing credentials, and full compromise of the web server account.

Attack surface

Reached over the network via crafted URIs to the blame, file, or stats pages; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit code exists in Exploit-DB, Packet Storm, and a vendor-adjacent blog, and EPSS is 0.8273 (99.65th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Upgrade Gitlist to 0.5.0 or later, which fixes the command injection.
• If upgrade is not possible, restrict network access to the Gitlist instance to trusted users only.
• Run Gitlist under a low-privilege account with no shell access and no access to sensitive files.
• Review web server and application logs for suspicious shell metacharacters in request URIs.

Detection

• Search web access logs for requests to blame/, file/, or stats/ paths containing shell metacharacters such as ;, |, $, `, or &&.
• Monitor for unexpected child processes spawned by the web server user (e.g., sh, bash, curl, wget).
• Alert on outbound network connections originating from the Gitlist host to unfamiliar destinations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.