Disclaimer: wild speculation below There's a strong possibility the vulnerability lay in their hosting setup rather than in the software application itself. T

Disclaimer: wild speculation below There's a strong possibility the vulnerability lay in their hosting setup rather than in the software application itself. There's an argument to be made that self-hosted software that are non-trivial to configure for security have "dev ux" type security bugs, but I doubt that'd constitute a CVE. It could also be unrelated to the git-web hosting config.