CVE-2026-82668
Received Received - Intake

Command Injection in GitList

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulDB

Description
A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82668
EUVD
EUVD-2026-68452

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
klaussilveira gitlist to 3.0.0-beta (exc)
klaussilveira gitlist 3.0.0-beta
klaussilveira gitlist 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in GitList 2.0.0. It exists in the getDefaultBranch function of src/SCM/System/Git/CommandLine.php. An attacker can remotely execute arbitrary commands by manipulating inputs to this function. The issue was patched in version 3.0.0-beta by adding the --no-textconv flag to Git commands to prevent execution of malicious textconv helper scripts.

Detection Guidance

Check GitList version with: gitlist --version or inspect the GitList web interface footer. Look for vulnerable CommandLine.php in src/SCM/System/Git/CommandLine.php. Search for .gitattributes files in repositories that may contain malicious textconv configurations. Monitor for unexpected git show or git blame command executions in logs.

Impact Analysis

If exploited, this vulnerability allows attackers to run arbitrary commands on the server running GitList. This could lead to full system compromise, data theft, or unauthorized access. The attack requires an attacker to have write access to a repository or trick a user into accessing a malicious repository.

Mitigation Strategies

Upgrade GitList to version 3.0.0-beta or later. Apply the patch 88cf2866083d5f7c20d9d565c45f828a7ad1516b if staying on older versions. Disable global safe.directory settings in Git config. Review and remove untrusted repositories. Restrict write access to repositories. Monitor for suspicious activity in GitList logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82668. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart