{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-47515 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2024-47515 is a high-severity path traversal vulnerability, published on 24 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-47515 and fix it if it is affected.\n\nWhat it is: CVE-2024-47515 is a high-severity path traversal vulnerability, published on 24 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-47515 in the wild and no public exploit code.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-47515/ (Markdown: https://insights.sbomify.com/CVE-2024-47515/index.md)","id":"CVE-2024-47515","markdown":"https://insights.sbomify.com/CVE-2024-47515/index.md","name":"CVE-2024-47515","record":{"aliases":["DEBIAN-CVE-2024-47515","GHSA-jc9g-44f2-xqh4","UBUNTU-CVE-2024-47515"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Pagure Git hosting","requires_auth":"low_privilege","summary":"A malicious user can exploit symbolic link handling in archive generation to disclose local files on the Pagure server.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-61","name":"UNIX Symbolic Link (Symlink) Following"}],"description":"A vulnerability was found in Pagure. Support of symbolic links during repository archiving of repositories allows the disclosure of local files. This flaw allows a malicious user to take advantage of the Pagure instance.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Pagure: generate_archive() follows symbolic links in temporary clones","id":"CVE-2024-47515","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"path_traversal","year":"2024"},"n_packages":0,"n_references":2,"next":{"headline":"Pagure: argument injection in pagurerepo.log()","id":"CVE-2024-47516"},"packages":[],"prev":{"headline":"Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #3","id":"CVE-2024-47509"},"products":[],"published":"2024-12-24","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-08-12","vendors":[]},"summary":"A malicious user can exploit symbolic link handling in archive generation to disclose local files on the Pagure server.","url":"https://insights.sbomify.com/CVE-2024-47515/"}