CVE-2008-4297: Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, w...

Security readout for executives and security teams

This is an old Mercurial hgweb access-control bug. Servers running Mercurial before 1.0.2 may allow a remote user to pull repository contents even when allowpull is disabled. Business risk is unintended disclosure of source code or repository data from exposed hgweb services. Exposure is most likely where legacy Mercurial versions before 1.0.2 still serve repositories through hgweb, especially internet-facing or partner-accessible instances with allowpull set to restrict pulls. Prioritize if any legacy Mercurial hgweb service remains exposed. The issue can disclose source code or repository contents, but the sources do not indicate active exploitation or broader system compromise. Mitigation focus: Upgrade Mercurial and hgweb to version 1.0.2 or later.; Apply relevant vendor security updates for affected distributions.; Restrict external access to legacy hgweb services until upgraded..

Prepared

Jun 28, 2026, 11:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.