Search
Find a vulnerability
Search criteria
4 vulnerabilities by klaussilveira
CVE-2026-82669 (GCVE-0-2026-82669)
Vulnerability from nvd – Published: 2026-08-31 09:15 – Updated: 2026-09-02 13:43 X_Open Source
VLAI
EPSS
VEX
Title
klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service
Summary
A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.0.0-beta can resolve this issue. The patch is named f67609d52c1812fa8a7ed80eae5e795cfd72115f. It is advisable to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 13:43 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397168 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397168/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82669 | third-party-advisory |
| https://vuldb.com/submit/893867 | third-party-advisory |
| https://github.com/klaussilveira/gitlist/issues/948 | exploitissue-tracking |
| https://github.com/klaussilveira/gitlist/commit/f… | patch |
| https://github.com/klaussilveira/gitlist/releases… | patch |
| https://github.com/klaussilveira/gitlist/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| klaussilveira | GitList |
Affected:
2.0.0
Unaffected: 3.0.0-beta cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82669",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T13:43:11.004551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T13:43:45.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*"
],
"modules": [
"XML Parsing"
],
"product": "GitList",
"vendor": "klaussilveira",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "unaffected",
"version": "3.0.0-beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "iswangxy (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.0.0-beta can resolve this issue. The patch is named f67609d52c1812fa8a7ed80eae5e795cfd72115f. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T09:15:10.349Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397168 | klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397168"
},
{
"name": "VDB-397168 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397168/cti"
},
{
"name": "CVE-2026-82669 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82669"
},
{
"name": "Submit #893867 | klaussilveira gitlist 2.0.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/893867"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/klaussilveira/gitlist/issues/948"
},
{
"tags": [
"patch"
],
"url": "https://github.com/klaussilveira/gitlist/commit/f67609d52c1812fa8a7ed80eae5e795cfd72115f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/klaussilveira/gitlist/releases/tag/3.0.0-beta"
},
{
"tags": [
"product"
],
"url": "https://github.com/klaussilveira/gitlist/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T17:02:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82669",
"datePublished": "2026-08-31T09:15:10.349Z",
"dateReserved": "2026-08-30T14:57:01.766Z",
"dateUpdated": "2026-09-02T13:43:45.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82668 (GCVE-0-2026-82668)
Vulnerability from nvd – Published: 2026-08-31 09:00 – Updated: 2026-08-31 10:26 X_Open Source
VLAI
EPSS
VEX
Title
klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection
Summary
A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 10:26 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397167 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397167/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82668 | third-party-advisory |
| https://vuldb.com/submit/893866 | third-party-advisory |
| https://github.com/klaussilveira/gitlist/issues/947 | exploitissue-tracking |
| https://github.com/klaussilveira/gitlist/commit/8… | patch |
| https://github.com/klaussilveira/gitlist/releases… | patch |
| https://github.com/klaussilveira/gitlist/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| klaussilveira | GitList |
Affected:
2.0.0
Unaffected: 3.0.0-beta cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82668",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T10:26:36.549515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T10:26:49.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*"
],
"modules": [
"Git Command Line"
],
"product": "GitList",
"vendor": "klaussilveira",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "unaffected",
"version": "3.0.0-beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "iswangxy (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T09:00:12.007Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397167 | klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397167"
},
{
"name": "VDB-397167 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397167/cti"
},
{
"name": "CVE-2026-82668 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82668"
},
{
"name": "Submit #893866 | klaussilveira gitlist 2.0.0 Configuration",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/893866"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/klaussilveira/gitlist/issues/947"
},
{
"tags": [
"patch"
],
"url": "https://github.com/klaussilveira/gitlist/commit/88cf2866083d5f7c20d9d565c45f828a7ad1516b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/klaussilveira/gitlist/releases/tag/3.0.0-beta"
},
{
"tags": [
"product"
],
"url": "https://github.com/klaussilveira/gitlist/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T17:02:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82668",
"datePublished": "2026-08-31T09:00:12.007Z",
"dateReserved": "2026-08-30T14:56:55.511Z",
"dateUpdated": "2026-08-31T10:26:49.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82669 (GCVE-0-2026-82669)
Vulnerability from cvelistv5 – Published: 2026-08-31 09:15 – Updated: 2026-09-02 13:43 X_Open Source
VLAI
EPSS
VEX
Title
klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service
Summary
A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.0.0-beta can resolve this issue. The patch is named f67609d52c1812fa8a7ed80eae5e795cfd72115f. It is advisable to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 13:43 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397168 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397168/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82669 | third-party-advisory |
| https://vuldb.com/submit/893867 | third-party-advisory |
| https://github.com/klaussilveira/gitlist/issues/948 | exploitissue-tracking |
| https://github.com/klaussilveira/gitlist/commit/f… | patch |
| https://github.com/klaussilveira/gitlist/releases… | patch |
| https://github.com/klaussilveira/gitlist/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| klaussilveira | GitList |
Affected:
2.0.0
Unaffected: 3.0.0-beta cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82669",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T13:43:11.004551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T13:43:45.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*"
],
"modules": [
"XML Parsing"
],
"product": "GitList",
"vendor": "klaussilveira",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "unaffected",
"version": "3.0.0-beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "iswangxy (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.0.0-beta can resolve this issue. The patch is named f67609d52c1812fa8a7ed80eae5e795cfd72115f. It is advisable to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T09:15:10.349Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397168 | klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397168"
},
{
"name": "VDB-397168 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397168/cti"
},
{
"name": "CVE-2026-82669 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82669"
},
{
"name": "Submit #893867 | klaussilveira gitlist 2.0.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/893867"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/klaussilveira/gitlist/issues/948"
},
{
"tags": [
"patch"
],
"url": "https://github.com/klaussilveira/gitlist/commit/f67609d52c1812fa8a7ed80eae5e795cfd72115f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/klaussilveira/gitlist/releases/tag/3.0.0-beta"
},
{
"tags": [
"product"
],
"url": "https://github.com/klaussilveira/gitlist/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T17:02:13.000Z",
"value": "VulDB entry last update"
}
],
"title": "klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82669",
"datePublished": "2026-08-31T09:15:10.349Z",
"dateReserved": "2026-08-30T14:57:01.766Z",
"dateUpdated": "2026-09-02T13:43:45.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82668 (GCVE-0-2026-82668)
Vulnerability from cvelistv5 – Published: 2026-08-31 09:00 – Updated: 2026-08-31 10:26 X_Open Source
VLAI
EPSS
VEX
Title
klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection
Summary
A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 10:26 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397167 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397167/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82668 | third-party-advisory |
| https://vuldb.com/submit/893866 | third-party-advisory |
| https://github.com/klaussilveira/gitlist/issues/947 | exploitissue-tracking |
| https://github.com/klaussilveira/gitlist/commit/8… | patch |
| https://github.com/klaussilveira/gitlist/releases… | patch |
| https://github.com/klaussilveira/gitlist/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| klaussilveira | GitList |
Affected:
2.0.0
Unaffected: 3.0.0-beta cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82668",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T10:26:36.549515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T10:26:49.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gitlist:gitlist:*:*:*:*:*:*:*:*"
],
"modules": [
"Git Command Line"
],
"product": "GitList",
"vendor": "klaussilveira",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "unaffected",
"version": "3.0.0-beta"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "iswangxy (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T09:00:12.007Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397167 | klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397167"
},
{
"name": "VDB-397167 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397167/cti"
},
{
"name": "CVE-2026-82668 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82668"
},
{
"name": "Submit #893866 | klaussilveira gitlist 2.0.0 Configuration",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/893866"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/klaussilveira/gitlist/issues/947"
},
{
"tags": [
"patch"
],
"url": "https://github.com/klaussilveira/gitlist/commit/88cf2866083d5f7c20d9d565c45f828a7ad1516b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/klaussilveira/gitlist/releases/tag/3.0.0-beta"
},
{
"tags": [
"product"
],
"url": "https://github.com/klaussilveira/gitlist/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T17:02:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82668",
"datePublished": "2026-08-31T09:00:12.007Z",
"dateReserved": "2026-08-30T14:56:55.511Z",
"dateUpdated": "2026-08-31T10:26:49.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}