CVE-2026-82668

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82668
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82668.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82668
Published
2026-08-31T09:00:12.007Z
Modified
2026-09-02T03:47:22.195190749Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
klaussilveira GitList Git Command Line CommandLine.php getDefaultBranch os command injection
Details

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addresses this issue. The name of the patch is 88cf2866083d5f7c20d9d565c45f828a7ad1516b. Upgrading the affected component is advised.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82668.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ]
}
References

Affected packages

Git / github.com/klaussilveira/gitlist

Affected ranges

Type
GIT
Repo
https://github.com/klaussilveira/gitlist
Events
Introduced
251b8a8b3c3dc9e715a4d6d950291e8eafaf244d
Fixed
88cf2866083d5f7c20d9d565c45f828a7ad1516b
Fixed
dfd648ca5cbdf41e4d34085e88919ef92a079ce6
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ]
}

Affected versions

2.*
2.0.0
Other
nightly

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82668.json"