CVE-2026-82668: GitList 2.0.0 OS Command Injection RCE

CVE-2026-82668 Overview

CVE-2026-82668 is an OS command injection vulnerability in klaussilveira GitList 2.0.0, a web-based Git repository viewer written in PHP. The flaw resides in the getDefaultBranch function within src/SCM/System/Git/CommandLine.php, part of the Git Command Line component. Attackers can manipulate input passed to this function to inject operating system commands. The attack is exploitable remotely without authentication or user interaction. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use against exposed instances. The issue is tracked as CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Remote, unauthenticated attackers can inject arbitrary OS commands through the Git Command Line component, executing them in the context of the GitList web application user.

Affected Products

klaussilveira GitList 2.0.0
Component: Git Command Line (src/SCM/System/Git/CommandLine.php)
Function: getDefaultBranch

Discovery Timeline

2026-08-31 - CVE-2026-82668 published to NVD
2026-08-31 - Last updated in NVD database
Patch commit - 88cf2866083d5f7c20d9d565c45f828a7ad1516b merged in the GitList repository
Fixed release - Version 3.0.0-beta published on GitHub

Technical Details for CVE-2026-82668

Vulnerability Analysis

GitList exposes Git repository metadata through a PHP web interface. The getDefaultBranch method in src/SCM/System/Git/CommandLine.php constructs and executes Git commands using values that flow from untrusted request data. Because the affected code path does not sufficiently neutralize command metacharacters or fully constrain Git subcommand options, attacker-controlled input can alter the executed shell or Git command line. This results in OS command injection [CWE-77] executed under the privileges of the web server process.

The upstream fix hardens Git command invocation. In related commit context, the maintainers added the --no-textconv flag to git show invocations to prevent Git textconv filters from being triggered on attacker-controlled content. Textconv filters can execute configured programs against blobs, which turns any untrusted repository or reference into a code execution primitive when combined with the injection point.

Root Cause

The root cause is improper neutralization of special elements passed to a Git command line. Input reaching getDefaultBranch is incorporated into a Git subprocess call without strict validation, and Git features such as textconv widen the impact of any injected argument. The vulnerability is a classic argument- and feature-injection flaw against a shell-adjacent command runner.

Attack Vector

The attack vector is network-based. An unauthenticated attacker sends a crafted HTTP request to a GitList endpoint that ultimately calls getDefaultBranch. The manipulated parameter reaches the Git command line, where injected options or metacharacters cause execution of attacker-chosen commands on the host running GitList.

php

     public function getCommit(Repository $repository, ?string $hash = 'HEAD'): Commit
     {
         $delimiter = $this->generateSafeCommitDelimiter();
-        $output = $this->run(['show', '--ignore-blank-lines', '-w', '-b', '--cc', $this->getCommitFormat($delimiter), $hash], $repository);
+        $output = $this->run(['show', '--no-textconv', '--ignore-blank-lines', '-w', '-b', '--cc', $this->getCommitFormat($delimiter), $hash], $repository);
         [$commit, $rawDiffBlock] = $this->parseFirstCommitData($repository, $output, $delimiter);
 
         $commit->setRawDiffs($rawDiffBlock);

Source: GitHub Commit 88cf286. The patch disables Git's textconv processing when reading commits, closing an execution path that attackers can leverage in conjunction with the injection flaw.

Detection Methods for CVE-2026-82668

Indicators of Compromise

Unexpected child processes spawned by the PHP-FPM or web server user with parents named git, sh, or bash.
HTTP requests to GitList routes containing shell metacharacters (;, |, backticks, $(), long option strings, or unusual --upload-pack/--config arguments.
Outbound network connections from the GitList host to unknown IPs shortly after Git repository browsing requests.
New or modified files under the GitList document root or system-writable directories not tied to a deployment.

Detection Strategies

Alert on git processes invoked with attacker-controlled flags such as --upload-pack, --exec, or -c core. originating from the web application user.
Correlate web access logs with process telemetry to link GitList HTTP requests to subsequent shell or Git command execution.
Use behavioral analytics to flag PHP interpreter processes spawning shells or network utilities such as curl, wget, nc, or python.

Monitoring Recommendations

Ingest web server access logs, PHP error logs, and endpoint process telemetry into a central analytics platform for correlation.
Monitor for anomalous Git command lines executed on servers hosting GitList, especially commands referencing external URLs or new remotes.
Track file integrity for GitList installation directories and repository storage paths.

How to Mitigate CVE-2026-82668

Immediate Actions Required

Upgrade GitList to version 3.0.0-beta or later, which contains patch commit 88cf2866083d5f7c20d9d565c45f828a7ad1516b.
Restrict network access to GitList instances so they are not reachable from untrusted networks or the public internet.
Run the GitList process under a dedicated, low-privilege account with no write access outside its required directories.
Review web and system logs for suspicious git invocations or shell spawns preceding the patch date.

Patch Information

The issue is addressed in the GitList 3.0.0-beta release. The corresponding fix is tracked in GitHub Issue #947 and applied in commit 88cf286. Additional advisory context is available at VulDB CVE-2026-82668.

Workarounds

Place GitList behind an authenticated reverse proxy or VPN until patching is complete.
Deploy a web application firewall rule to block shell metacharacters and Git option-style tokens in query parameters targeting GitList endpoints.
Disable or remove the GitList instance if it is not business-critical and cannot be immediately upgraded.

bash

# Upgrade GitList to the fixed release
cd /var/www/gitlist
git fetch --tags
git checkout 3.0.0-beta

# Optional: restrict access at the reverse proxy (nginx example)
# location /gitlist/ {
#     allow 10.0.0.0/8;
#     deny  all;
#     proxy_pass http://127.0.0.1:8080;
# }