CVE-2014-5023: Repository.php in Gitter, as used in Gitlist, allows remote attackers with commit privileges to execute arb...

Security readout for executives and security teams

This CVE describes command execution in Gitter as used by Gitlist. An attacker who can create commits or branch names in a repository could use a malicious branch name to make the server run unintended commands. Business urgency depends on whether Gitlist or Gitter-backed repository browsing is exposed and who has commit rights. Exposure is most likely where Gitlist uses Gitter to browse repositories and untrusted or semi-trusted users can push commits or create branches. Internet exposure raises impact, but the CVE requires commit privileges according to the public description. Prioritize review if Gitlist is internet-facing or accepts commits from contractors, customers, or broad internal groups. The issue can lead to server command execution, but urgency is lower where only highly trusted administrators can create branches. Mitigation focus: Identify any deployed Gitlist instances using Gitter Repository.php.; Check project or vendor guidance for fixed versions or patches.; Restrict commit and branch-creation rights to trusted users only..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.