CVE-2018-14912: CGit directory traversal in HTTP clone objects endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote file disclosure with public exploit code and very high EPSS, but no KEV listing and no evidence of ransomware use.

What it is

CGit before 1.2.1 contains a directory traversal flaw in cgit_clone_objects when enable-http-clone is left enabled. A crafted request such as cgit/cgit.cgi/git/objects/?path=../ lets an unauthenticated remote user read files outside the intended repository object path. Because cgit is commonly exposed as a public web front end for Git repositories, the flaw matters for any instance that has not disabled HTTP cloning.

Impact

An attacker can read arbitrary files reachable by the cgit process, exposing repository data and any sensitive files readable by that service account. The CVSS vector confirms high confidentiality impact with no integrity or availability effect.

Attack surface

Reached over the network through the cgit HTTP interface, specifically the git/objects/ endpoint when enable-http-clone is not turned off. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Public exploit references exist (Project Zero issue and Exploit-DB 45195), and EPSS is very high at 0.9288 (99.8th percentile), though the CVE is not listed in CISA KEV.

What to do

• Upgrade CGit to 1.2.1 or later, or apply the vendor patch referenced in the cgit mailing list advisory.
• If immediate upgrade is not possible, disable HTTP cloning by setting enable-http-clone=0 in cgitrc.
• Apply the Debian security updates (DSA-4263 and the LTS announcement) for affected Debian packages.
• Restrict network access to cgit instances that do not need to serve HTTP clones publicly.
• Run cgit under a low-privilege account with no access to sensitive files outside the repository tree.

Detection

• Search web access logs for requests to git/objects/ containing path=../ or other traversal sequences.
• Alert on URL-encoded traversal patterns (%2e%2e) or repeated ../ segments in cgit request paths.
• Monitor for unusual file reads by the cgit process user outside the repository directory.
• Review cgit configuration to confirm enable-http-clone status across all instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.