GCVE - cpe:2.3:a:gollum_project:gollum:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gollum_project:gollum:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Gollum Project (`de686f15-d2a9-5877-ba86-aae6cfd4ce8c`)
Product	Gollum (`74189cdf-f627-501b-9468-2fa70d15273f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:gem/gollum`	purl2cpe	2026-06-01 10:14:58.872960
`pkg:github/gollum/gollum`	purl2cpe	2026-06-01 10:14:58.872963
`pkg:rpm/opensuse/rubygem-gollum`	purl2cpe	2026-06-01 10:14:58.872965

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-35305`	vulnerable	2026-06-08 05:25:01.017852	Details available Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog. Published: 2022-07-15T13:40:53.000Z Updated: 2026-07-09T00:12:18.306Z Open on db.gcve.eu Reference links https://github.com/Szarny/ https://github.com/gollum/ https://github.com/gollum/gollum/releases/tag/v5.1.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-7314`	vulnerable	2026-06-08 05:07:00.406484	Details available The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check. Published: 2015-10-03T10:00:00.000Z Updated: 2024-08-06T07:43:46.166Z Open on db.gcve.eu Reference links https://github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1 http://jvn.jp/en/jp/JVN27548431/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000149 https://github.com/gollum/gollum/issues/1070 http://www.openwall.com/lists/oss-security/2015/09/22/12	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9489`	vulnerable	2026-06-08 05:06:11.942090	Details available The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags. Published: 2017-10-17T14:00:00.000Z Updated: 2024-08-06T13:47:41.328Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2015/01/03/19 http://www.securityfocus.com/bid/71499 https://github.com/gollum/grit_adapter/commit/4520d973c81fecfebbeacd2ef2f1849d763951c7 https://github.com/gollum/gollum/issues/913	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.