1 file changed, 6 insertions, 0 deletions
diff --git a/source/ui-stats.c b/source/ui-stats.c
index 6cb2653..555b795 100644
--- a/source/ui-stats.c
+++ b/source/ui-stats.c
@@ -452,6 +452,12 @@ void cgit_show_stats(void)
 		cgit_print_error_page(400, "Bad Request", "Statistics type disabled: %s", period->name);
 		return;
 	}
+	// A leading colon makes git read the path as a pathspec with magic,
+	// which can end the request inside git.
+	if (ctx.qry.path && ctx.qry.path[0] == ':') {
+		cgit_print_error_page(400, "Bad Request", "Invalid path");
+		return;
+	}
 	if (collect_stats(period, &authors))
 		return;
 	cgit_qsort(authors.items, authors.nr, sizeof(struct string_list_item), cmp_total_commits);