Unscored severity · published Jan 21, 2009
CVE-2008-5916
gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local…
–
CVSS
0.5%
EPSS
No
On KEV
Description
gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before 1.5.5.6, 1.5.4.x before 1.5.4.7, and other versions after 1.4.3 allows local repository owners to execute arbitrary commands by modifying the diff.external configuration variable and executing a crafted gitweb query.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
Git · Git
1.4.3.1; 1.4.3.2; 1.4.3.3; 1.4.3.4; 1.4.3.5; 1.4.4; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5916
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5916
marc.info
http://marc.info/?l=git&m=122975564100860&w=2
marc.info
http://marc.info/?l=linux-kernel&m=122975564100863&w=2:
osvdb.org
http://osvdb.org/50918
secunia.com
http://secunia.com/advisories/33282
secunia.com
http://secunia.com/advisories/33964
secunia.com
http://secunia.com/advisories/34194
More from Git
8.0
CVE-2025-48384
Git allows arbitrary code execution through broken config quoting
9.8
CVE-2022-25648
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection
9.0
CVE-2024-32002
Git is a revision control system
8.8
CVE-2024-52005
Git is a source code management tool
8.8
CVE-2022-39260
Git vulnerable to Remote Code Execution via Heap overflow in `git shell`