Directory traversal vulnerability in the cgitparsereadme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.

Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to add files to execute arbitrary commands via the --plug-in argument to the highlight command.

An cross-site scripting (XSS) flaw was found in the way cgit, a fast web interface for Git, processed the file name in the rename hint. A remote attacker, valid CGit user with push access to the repository, could use this flaw to execute arbitrary web script or HTML code via a push commit message, renaming some file to a file with specially-crafted file name.

References: [1] http://hjemli.net/pipermail/cgit/2011-July/000276.html

Off-by-one error in the convertqueryhexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.