EUVD-2026-57369
GHSA-29mg-2cr6-59xc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, unauthenticated, low-complexity input to a git command sink with no user interaction; argument injection can reach high confidentiality, integrity, and availability impact.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Specifically crafted inputs may lead to git argument injection in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Remote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-controlled arguments into git command invocations through specially crafted inputs. Because Allura is a project-hosting and forge platform that shells out to git, this argument injection (CWE-88) can be leveraged to influence git behavior and, depending on the invoked subcommand, achieve command execution against the hosting server; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.18%).
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires reaching an Allura code path that passes attacker-controlled input into a git command line - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), describing a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity, and availability impact - a genuinely high-severity profile, and even a mid-sized municipal IT team in kielce running a self-hosted Allura forge should treat patching as urgent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker interacts with an internet-exposed Allura instance and submits a crafted value (for example a repository name, ref, or import/clone parameter) that begins with a dash so it is interpreted by git as an additional command-line option rather than data. When Allura shells out to git with that unsanitized argument, the injected flag alters git's behavior - potentially reading or writing unintended files or triggering command execution on the server. … |
| Remediation | Vendor-released patch: upgrade Apache Allura to version 1.19.1, which the project explicitly states fixes this issue; this is the primary and recommended remediation per the release note at https://allura.apache.org/posts/2026-allura-1.19.1.html and the advisory at https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan your infrastructure to identify all Apache Allura instances running versions prior to 1.19.1 and verify patch availability from vendor repositories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Allura
View allInsecure Direct Object Reference (IDOR) in Apache Allura before 1.19.1 allows unauthorized access to multiple Artifact t
Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an at
Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today