Description

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.0.0-beta can resolve this issue. The patch is named f67609d52c1812fa8a7ed80eae5e795cfd72115f. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T10:16:50.130Z",
  "pubdate": "2026-08-31T10:16:50.130Z",
  "executiveSummary": "A critical vulnerability exists in klaussilveira GitList 2.0.0, specifically within the XML parsing logic implemented in the src/SCM/System/Git/CommandLine.php file.\nThe vulnerability involves improper handling of XML inputs, which can be leveraged to conduct a Denial of Service (DoS) attack.\nThis flaw allows a remote, unauthenticated attacker to disrupt system availability by supplying maliciously crafted XML data that exhausts server resources during the parsing process.\nGiven that the exploit is currently public, the risk of exploitation is significantly elevated for organizations running the vulnerable version 2.0.0.\nSuccessful exploitation results in service instability or complete application failure, necessitating immediate remediation efforts.\nThe vulnerability is resolved in version 3.0.0-beta via the application of patch f67609d52c1812fa8a7ed80eae5e795cfd72115f.",
  "technicalDetails": "The vulnerability is located within the src/SCM/System/Git/CommandLine.php file, specifically involving the use of the SimpleXMLElement class to process XML data.\nThe root cause of this issue lies in the insecure configuration of the XML parser, which likely fails to disable external entity loading or fails to implement necessary resource constraints (such as entity expansion limits) when processing user-supplied XML input.\nIn the context of PHP's SimpleXMLElement, an attacker can provide a specially crafted XML payload containing nested entities or references to external resources. When the parser attempts to resolve these entities, it can trigger an exponential increase in memory consumption or CPU cycles—a classic 'XML Bomb' or Billion Laughs attack—leading to resource exhaustion.\nThe attack flow proceeds as follows: 1) The attacker identifies an input vector within the GitList component that utilizes the affected SimpleXMLElement function to process XML data. 2) The attacker crafts a malicious XML payload designed to trigger excessive resource consumption upon parsing. 3) The payload is transmitted to the application via an available network interface. 4) The server-side component processes the input, leading to a hang, process crash, or system-wide resource depletion.\nThis vulnerability is remotely exploitable without requiring prior authentication or specific user privileges. The attack targets the core parsing logic, meaning the impact is experienced directly by the application process executing the PHP script. Once exploited, the application becomes unresponsive to legitimate user requests, effectively denying service to the platform.\nBecause the vulnerability is triggered during the instantiation or parsing phase of the SimpleXMLElement object, any input endpoint that passes user-controlled data to this function is potentially vulnerable. The lack of proper input validation and the absence of secure parser flags (such as LIBXML_NONET or libxml_disable_entity_loader, where applicable) are the primary technical deficiencies in the affected version.\nThe impact is severe in terms of availability, as the resource exhaustion can crash the PHP worker process, potentially affecting the hosting web server depending on the execution environment."
}