Executive brief
GitList is a web-based Git repository viewer that allows developers to browse and interact with Git repositories through a browser interface. A vulnerability in the Git command-line interface component allows an attacker to inject arbitrary operating system commands, potentially gaining control of the server. This could lead to unauthorized access, data theft, or complete compromise of systems hosting GitList.
Technical details
The vulnerability is an OS command injection flaw in the getDefaultBranch function within src/SCM/System/Git/CommandLine.php. The vulnerable component fails to properly sanitize user input before passing it to system command execution, allowing an attacker to inject arbitrary shell commands. The attack is remotely exploitable without authentication requirements. An attacker can execute arbitrary commands with the privileges of the web server process. The vulnerability is fixed in version 3.0.0-beta, with patch 88cf2866083d5f7c20d9d565c45f828a7ad1516b addressing the issue by preventing textconv parameter injection.
Affected products
- Klaus Silveira GitList 2.0.0
Timeline
- 2026-08-31: disclosed: Public disclosure of CVE-2026-82668
- 2026: patched: Fix available in version 3.0.0-beta with patch 88cf2866083d5f7c20d9d565c45f828a7ad1516b