Description

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T09:17:05.123Z",
  "pubdate": "2026-08-31T09:17:05.123Z",
  "executiveSummary": "A critical OS command injection vulnerability exists in klaussilveira GitList version 2.0.0, specifically within the getDefaultBranch function of the src/SCM/System/Git/CommandLine.php component.\nThe vulnerability allows remote, unauthenticated attackers to execute arbitrary system commands on the underlying host operating system by manipulating input that is passed to the command line interface without adequate sanitization.\nThis flaw represents a severe security risk as it facilitates remote code execution (RCE), potentially leading to complete system compromise, unauthorized data access, and lateral movement within the infrastructure.\nThe exploit path is publicly available, significantly increasing the probability of active exploitation in the wild. Organizations utilizing GitList 2.0.0 are at high risk until the affected component is updated or remediated.",
  "technicalDetails": "The vulnerability originates from insecure handling of input within the getDefaultBranch function located in src/SCM/System/Git/CommandLine.php. In this component, the application constructs shell commands by directly concatenating user-supplied or repository-controlled parameters into a string that is subsequently executed via the operating system shell.\nThe root cause is a failure to properly sanitize or escape meta-characters used by the shell, such as backticks, semicolons, pipes, or command separators. Because the Git command line utility is invoked with insufficiently filtered input, an attacker can supply malicious arguments that terminate the intended command and append arbitrary system commands.\nThe attack flow typically involves the attacker crafting a malicious request targeting the GitList repository management functionality that triggers a call to getDefaultBranch. By injecting shell metacharacters into the branch name or repository identifier, the attacker forces the system to execute the injected payload with the privileges of the web server process (e.g., www-data).\nGiven that the application processes this input without robust input validation or the use of safe execution wrappers (such as proc_open with an array of arguments rather than a raw shell string), the command injection is trivial to execute remotely.\nExploitation does not require authentication or elevated privileges, making it accessible to any network-exposed instance. Upon successful execution, the injected payload can facilitate the exfiltration of environment variables, configuration files, SSH keys, or the deployment of secondary malware/backdoors.\nPost-exploitation impact is limited only by the permissions of the user account running the GitList service, though typical environments allow for significant persistence and potential privilege escalation if kernel or local service vulnerabilities exist."
}