PT-2026-41558 · Gitbucket · Gitbucket

Published 2026-05-17 · Updated 2026-05-27 · CVE-2018-25332

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitBucket version 4.23.1

Description An issue allows unauthenticated remote code execution through weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the 'git-lfs' endpoint, and execute system commands through an exposed exploit endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2018-25332

Affected Products

Gitbucket

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-25332 · Security Note
• https://exploit-db.com/exploits/44668 · Patch
• https://github.com/gitbucket/gitbucket · Note
• https://vulncheck.com/advisories/gitbucket-unauthenticated-remote-code-execution · Note
• https://security.szurek.pl · Note
• https://t.me/cveNotify/164930 · Telegram Post
• https://t.me/CVEtracker/54057 · Telegram Post