GitList CVE-2026-82669

No authentication is required (CVSS PR:N) and no user interaction beyond browsing is needed (UI:N). The critical limiting condition is that the attacker must control or influence git commit content in at least one repository that the vulnerable GitList instance browses - either by having direct push access to such a repository, or by the GitList deployment being configured to display repositories sourced from untrusted parties. GitList deployments that only expose repositories with fully controlled, trusted commit histories are not meaningfully at risk from external actors. The availability impact is scoped to the GitList PHP process only (VA:L); the underlying git repository data on disk is not affected. Exploitation does not require any specific non-default configuration of GitList beyond normal operation.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects low-complexity unauthenticated remote exploitation, which is operationally significant even though the sole impact is limited availability (VA:L) - no confidentiality or integrity loss is associated with this flaw. No EPSS score was provided in the input data, so probabilistic exploitation frequency cannot be quantified. The absence of a CISA KEV listing means confirmed widespread active exploitation is not established; the E:P modifier and GitHub issue reference confirm a public proof-of-concept exists, lowering the skill bar for attackers. The practical blast radius is limited to disrupting the GitList web interface - underlying git repository data is unaffected. For public-facing or internally critical GitList instances, prompt patching is warranted given the zero-authentication, publicly documented attack path. For isolated or internal deployments with network access controls, priority is moderate.

An attacker with write access to any git repository browsed by a vulnerable GitList instance pushes a commit whose message or metadata is crafted to trigger pathological behavior in SimpleXMLElement - for example, malformed XML sequences or deeply nested structures embedded in commit fields. When any user (or the attacker directly) causes GitList to render a page that calls parseCommitsDataXml against that repository's log output, the PHP process crashes or hangs, making the GitList service unavailable. A public proof-of-concept is documented in GitHub issue #948 (https://github.com/klaussilveira/gitlist/issues/948).