Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame (2) file or (3) stats page as demonstrated by requests to blame/master/ master/ and stats/master/.