CVE-2018-25332

9.3 criticalEPSS 0.6%

Critical (9.3) in gitbucket gitbucket. EPSS 0.6% chance of exploitation in the next 30 days.

GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-05-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitbucket:gitbucket

References

https://github.com/gitbucket/gitbucket
https://security.szurek.pl/
https://www.exploit-db.com/exploits/44668
https://www.vulncheck.com/advisories/gitbucket-unauthenticated-remote-code-execution

Check your stack JSON