CVE-2018-1000533 in the critical feed json
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` functi…
published 2018-06-26 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1925
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 72.6%
- EPSS 72.6% chance of exploitation in 30 days, percentile 99.4%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
Patch / fix
Timeline
- First public exploit (Metasploit exploit/multi/http/gitlist_arg_injection)
- Published
Exploit prediction
72.62% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/gitlist_arg_injection GitList v0.6.0 Argument Injection Vulnerability metasploit exploit, excellent rank, 2018-04-26
- Nuclei template GitList < 0.6.0 Remote Code Execution nuclei detection template
- security.szurek.pl https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/klaussilveira/gitlist/commit/87b8c26b023c3fc37f0796b14bb13710f397b322
patch, third-party-advisory
-
security.szurek.pl
/exploit-bypass-php-escapeshellarg-escapeshellcmd.html
exploit, third-party-advisory
Sources
- CVE List CVE-2018-1000533
- NVD CVE-2018-1000533
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.