Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by Aabideen2 - 03.11.2026
Last edited by cbay - 05.11.2026

This is a REGRESSION of  FS#532  (Exposed .git repository, previously rated High). The .git directory on security.alwaysdata.com is still publicly served as of 2026-11-04, unauthenticated:

GET https://security.alwaysdata.com/.git/HEAD → 200, body "ref: refs/heads/master"
GET https://security.alwaysdata.com/.git/config → 200 (Flyspray clone config, remote origin github.com/flyspray/flyspray.git)
GET https://security.alwaysdata.com/.git/logs/HEAD → 200 (336 bytes: clone 2024-01, pull fast-forward 2026-07-13)
GET https://security.alwaysdata.com/.git/refs/heads/master → 200 (commit a1ffafd65d5662d69e8b0334315b857449e3ea38)

Impact: full git history of the security-reporting infrastructure (Flyspray + customizations, committer names/emails) downloadable by anyone. Exposure isolated to the tracker — /.git/HEAD returns 404 on www/admin/webmail/api.alwaysdata.com.

Discipline: PoC stopped at metadata files (HEAD/config/logs/refs). No git objects downloaded, no exfiltration.

Note:  FS#527  (ProxyPass SSRF regression) was previously accepted as a new report; filing this regression the same way.