A vulnerability has been reported in cgit, which can be exploited by malicious people to disclose certain sensitive information.
Input passed via the "url" GET parameter to / is not verified before being used to read files. This can be exploited to read arbitrary files from local resources via directory traversal sequences.
Successful exploitation requires cgit to be configured to use a readme file from the file system (configured to use a readme from a git repository by default).
