CVE-2012-4548: Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenti...

Security readout for executives and security teams

This flaw affects cgit installations where authenticated users can add repository files. A crafted file-related input could make cgit’s syntax-highlighting helper pass unsafe arguments to the highlight program, leading to arbitrary command execution on the server. Exposure is likely limited to older cgit deployments using the affected syntax-highlighting helper and allowing authenticated users to add files. Public internet reachability increases urgency, but the bundle does not prove broad exposure. Prioritize remediation for any internet-facing or shared cgit service with non-admin contributors. The business risk is server command execution, but the attacker needs authenticated file-add access. Mitigation focus: Inventory cgit deployments and identify versions at or before 9.0.3.; Review vendor advisories and the upstream commit for the corrected behavior.; Apply distribution or upstream cgit updates recommended by the vendor..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.