EUVD-2026-38135Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable PHP endpoint; AC:H because exploitation requires knowledge of specific untrusted parameter structure; only low confidentiality disclosure with zero integrity or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.
AnalysisAI
Information disclosure in GNU Savane's file-serving layer (frontend/php/file.php) allows network-accessible, unauthenticated remote attackers to bypass file authorization controls by supplying untrusted user-controlled data that the application incorrectly treats as authoritative in its access decision logic. Affected installations span Savane 3.14 through 3.17, confirmed by EUVD-2026-38135 and acknowledged via an FSF public statement. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H CVSS rating suggests non-trivial exploitation rather than a trivially automated mass-scan scenario.
Technical ContextAI
GNU Savane is the PHP-based project management platform powering GNU Savannah, the free software hosting service operated by the Free Software Foundation. The flaw is localized to frontend/php/file.php at lines 113 and 123 in the release-3.17 branch, as confirmed by direct source references to the cgit repository. CWE-696 (Incorrect Behavior Order) describes a situation where the software performs related behaviors in the wrong sequence - here, user-controlled HTTP input is consumed as part of an authorization decision before it has been validated or replaced with server-side authoritative session data. CPE cpe:2.3:a:gnu:savane:*:*:*:*:*:*:*:* covers the affected product family. The consequence is that an attacker who correctly manipulates the relevant request parameter can circumvent file-level access restrictions, leading to limited confidentiality disclosure aligned with the C:L CVSS metric.
RemediationAI
No vendor-released patch with an exact fix version has been identified from available data at time of analysis. Operators should monitor the FSF statement at https://www.fsf.org/news/statement-regarding-gnu-savannah-security-reports and the upstream cgit repository for a patched release. As compensating controls: restrict HTTP access to frontend/php/file.php via web server ACLs or WAF rules, limiting access to authenticated sessions only at the network layer (trade-off: may break legitimate anonymous file downloads if that is an intended feature); audit and harden the PHP authorization logic at lines 113 and 123 of file.php to replace user-supplied parameters with server-side session-derived values before making access decisions; and enable detailed logging on that endpoint to detect anomalous parameter manipulation during the interim period. The VulDB advisory at https://vuldb.com/vuln/372570 may contain additional remediation guidance as it is updated.
An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_hea
An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate
Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary fil
Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges
Same weakness CWE-696 – Incorrect Behavior Order
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today