What is the CVSS score of EUVD-2026-57369?

EUVD-2026-57369 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache Allura are affected by EUVD-2026-57369?

Apache Allura, a project hosting and code management platform, contains a critical remote code execution vulnerability affecting all versions before 1.19.1 that permits unauthenticated attackers to…. A patch is available.

How to fix or mitigate EUVD-2026-57369?

Within 24 hours, scan your infrastructure to identify all Apache Allura instances running versions prior to 1.19.1 and verify patch availability from vendor repositories. Within 7 days, deploy the patch by upgrading all affected instances to Apache Allura version 1.19.1 or later, following the vendor's documented upgrade procedure to ensure data integrity during the transition. Within 30 days, complete validation testing to confirm all Allura deployments are running patched versions, document the remediation in your vulnerability management system, and update your software asset inventory.

Apache Allura EUVD-2026-57369

| CVE-2026-73240 CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-08-12 apache

GHSA-29mg-2cr6-59xc

Apache Code Injection Apache Allura Apache Software Foundation

9.8

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.8 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable, unauthenticated, low-complexity input to a git command sink with no user interaction; argument injection can reach high confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 13, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Aug 13, 2026 - 16:22 NVD

9.8 (CRITICAL)

Patch available

Aug 12, 2026 - 18:17 EUVD

Analysis Generated

Aug 12, 2026 - 17:36 vuln.today

CVE Published

Aug 12, 2026 - 16:41 cve.org

HIGH

DescriptionCVE.org

Specifically crafted inputs may lead to git argument injection in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Articles & Coverage 1

News 6 New Apache Vulnerabilities - 6 High Severity, No POC Available Aug 13, 2026

AnalysisAI

Remote code and command injection in Apache Allura before 1.19.1 lets unauthenticated attackers smuggle attacker-controlled arguments into git command invocations through specially crafted inputs. Because Allura is a project-hosting and forge platform that shells out to git, this argument injection (CWE-88) can be leveraged to influence git behavior and, depending on the invoked subcommand, achieve command execution against the hosting server; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.18%).

Technical ContextAI

Apache Allura is an open-source forge/project-hosting platform (the software historically behind SourceForge) that manages source repositories, tickets, wikis, and discussions. To service repository operations it invokes the underlying git binary, passing user-influenced values (such as repository names, refs, or clone/URL parameters) on the command line. The root cause is CWE-88 (Improper Neutralization of Argument Delimiters, i.e. argument injection): user-supplied strings that begin with '-' or otherwise resemble git options are not adequately separated from actual command-line flags, so crafted input can inject additional git arguments (for example options like --upload-pack or --output) that change what git does. The single affected CPE is cpe:2.3:a:apache_software_foundation:apache_allura:*, and the flaw is fixed in Allura 1.19.1.

RemediationAI

Vendor-released patch: upgrade Apache Allura to version 1.19.1, which the project explicitly states fixes this issue; this is the primary and recommended remediation per the release note at https://allura.apache.org/posts/2026-allura-1.19.1.html and the advisory at https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv. No official pre-patch workaround is published, so if immediate upgrade is not possible, reduce exposure by restricting network access to the Allura instance (place it behind authentication or a VPN and avoid exposing the forge to anonymous internet users), and consider temporarily disabling or gating repository operations that accept user-supplied repository names, URLs, or refs - recognizing that this degrades core forge functionality (clone/import, repo creation) and is only a stopgap until 1.19.1 is deployed.