CVE-2026-13540

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13540

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13540.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13540

Published

2026-06-29T05:45:07.911Z

Modified

2026-07-15T01:48:50.536305278Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery

Details

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The patch is named 487a9b980f56aa73b6a044b1e86a92eed5043215. To fix this issue, it is recommended to deploy a patch.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13540.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "VulDB"
}

References

Affected packages

Git / github.com/gitbucket/gitbucket

Affected ranges

Type

GIT

Repo

https://github.com/gitbucket/gitbucket

Events

Introduced

90b9c17d6eb0a5119889af3b0f4a17c5bcb86d5f

Fixed

487a9b980f56aa73b6a044b1e86a92eed5043215

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.46.0"
        },
        {
            "last_affected": "4.46.0"
        },
        {
            "introduced": "4.46.1"
        },
        {
            "last_affected": "4.46.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

4.*

4.46.0

4.46.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13540.json"