CVE-2004-0778: GNU Cvs

Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days.

CVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned.

Affected products

• GNU Cvs: from 1.11.0, before 1.11.17 (fixed in 1.11.17); from 1.12.0, before 1.12.9 (fixed in 1.12.9)

Published 2004-10-20. Last modified 2026-06-16.