https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2010-2447.htmlhttps://patchthecve.com/cve/CVE-2010-2447.htmlTue, 16 Jun 2026 23:20:46 +0000CRITICAL 9.8: gitolite before 1.4.1 does not filter src/ or hooks/ from path names.https://patchthecve.com/cve/CVE-2018-20683.htmlhttps://patchthecve.com/cve/CVE-2018-20683.htmlWed, 17 Jun 2026 01:53:19 +0000HIGH 8.1: commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P.https://patchthecve.com/cve/CVE-2013-7203.htmlhttps://patchthecve.com/cve/CVE-2013-7203.htmlWed, 17 Jun 2026 00:01:31 +0000MEDIUM 5.5: gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup.https://patchthecve.com/cve/CVE-2013-4451.htmlhttps://patchthecve.com/cve/CVE-2013-4451.htmlTue, 16 Jun 2026 23:57:15 +0000CRITICAL 9.8: gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.https://patchthecve.com/cve/CVE-2018-16976.htmlhttps://patchthecve.com/cve/CVE-2018-16976.htmlWed, 17 Jun 2026 01:45:09 +0000HIGH 8.1: Gitolite before 3.6.9 does not (in certain configurations involving @all or a regex) properly restrict access to a Git repository that is in the process of being migrated until the full set of migration steps has been completed. This can allow valid users to obtain unintended access.