CVE-2018-1000533
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in searchTree function that can result...
- Published
- Jun 26, 2018
- Updated
- Aug 5, 2024
- Assigning CNA
- mitre
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.4%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
Sources
http/cves/2018/CVE-2018-1000533.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: word($.matchers[*].type)
gitlist/CVE-2018-1000533
GitList 0.6.0 Remote Command Execution (CVE-2018-1000533)
Vulhub vulnerability labsmodules/exploits/multi/http/gitlist_arg_injection.rb
Metasploit Framework modulesDeclared conditions
- platform: PHP($.exploit_multi/http/gitlist_arg_injection.platform)
- verification: check_declared($.exploit_multi/http/gitlist_arg_injection.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.