CVE-2024-4981

What it actually does

The flaw permits a malicious git repository containing symbolic links to cause the Pagure server to follow those links and expose or incorporate content located outside the repository's intended boundaries.

Why it matters to the business

Attackers could access sensitive files stored on the server, resulting in data exposure, compliance violations, and operational risk for organizations relying on the service; low exploit prevalence reduces immediate urgency but patching remains necessary.

How an attack unfolds

An attacker crafts a git repository that includes symbolic links pointing to files outside the repo directory, submits the repository to the Pagure instance, and the server processes or displays the repository in a manner that follows the links and reveals external content.

How to fix it

Upgrade affected webkitgtk packages on Ubuntu 14.04 LTS to version 2.4.8-1ubuntu1~ubuntu14.04.1 and on Ubuntu 16.04 LTS to version 2.4.9-2ubuntu2; apply equivalent patches for Pagure if a distinct fix is released.

How to confirm the fix worked

Verify package versions match the listed fixed releases, test repository submission with symbolic links to confirm external content is no longer accessible, and review server logs for prior symlink traversal attempts.

Typical attack path

1. Create a git repository containing symbolic links targeting external paths
2. Submit the repository to the Pagure server via push or import
3. Trigger repository indexing, viewing, or diff operations
4. Access or exfiltrate content exposed from outside the repository

How to detect it

Search web server and application logs for repository submissions containing paths with ../ sequences or symlink references; review file access logs for unexpected reads outside repository directories during import or display operations.

What your security team should do

• Prioritize patching the affected Ubuntu webkitgtk packages within standard maintenance windows given the absence of KEV status
• Monitor EPSS trend and re-evaluate if scores rise above 0.1
• Audit git repository import workflows for symlink handling until patches are deployed