Executive brief
GitList is an elegant web interface for browsing Git repositories. A vulnerability in its XML parsing component allows remote attackers to cause a denial of service by sending specially crafted requests, potentially disrupting access to hosted repositories for all users.
Technical details
The vulnerability exists in the XML parsing logic within src/SCM/System/Git/CommandLine.php, specifically in the SimpleXMLElement function handling. An attacker can manipulate XML input to trigger a denial of service condition by causing the parser to become unresponsive or crash. The attack is remotely exploitable without authentication requirements. Upgrading to version 3.0.0-beta or applying patch f67609d52c1812fa8a7ed80eae5e795cfd72115f resolves the issue by refactoring the commit format parsing mechanism.
Affected products
- klaussilveira GitList 2.0.0
Timeline
- 2026-08-31: disclosed
- 2026-08-22: patched: Patch f67609d52c1812fa8a7ed80eae5e795cfd72115f committed; version 3.0.0-beta available