CVE-2024-47516 Pagure: argument injection in pagurerepo.log()
Attackers can achieve remote code execution on Pagure instances via argument injection in Git history retrieval.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47516?
CVE-2024-47516 is a critical command injection vulnerability, published on 25 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure instance.
Weakness: CWE-88
Which versions are affected by CVE-2024-47516?
How do I fix CVE-2024-47516?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-47516 being exploited?
There is no known exploitation of CVE-2024-47516 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-47516, GHSA-cfhx-3wmq-q5rg, UBUNTU-CVE-2024-47516.