CVE-2011-1572: Directory traversal vulnerability in the Admin Defined Commands (ADC) feature in gitolite before 1.5.9.1 al...

Security readout for executives and security teams

CVE-2011-1572 is a flaw in gitolite’s Admin Defined Commands feature before version 1.5.9.1. If an exposed installation uses that feature, a remote attacker could abuse path traversal handling to run arbitrary commands on the gitolite host. This is most relevant to older self-hosted Git administration systems. Exposure is likely limited to systems running gitolite before 1.5.9.1, especially where Admin Defined Commands were enabled or reachable by remote users. Modern environments are unlikely to be affected unless old gitolite deployments or archived server images remain in use. Prioritize remediation if any legacy gitolite server remains in production or supports privileged repository administration. The business risk is server compromise from an old Git administration feature. If no gitolite deployment exists, this can be closed after documented inventory validation. Mitigation focus: Upgrade gitolite to version 1.5.9.1 or later where applicable.; Apply vendor backported fixes, such as relevant Debian security updates.; Disable Admin Defined Commands if they are not required..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.