Description
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.
Published: 2026-10-28
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade Kalifast to 2026061802

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.
Title KaliFast Project Management Platform ei_git_repo_url OS Command Injection
First Time appeared Eisge
Eisge kalifast
Weaknesses CWE-78
CPEs cpe:2.3:a:eisge:kalifast:*:*:*:*:*:*:*:*
cpe:2.3:a:eisge:kalifast:2026.02.1:*:*:*:*:*:*:*
Vendors & Products Eisge
Eisge kalifast
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Eisge Kalifast
cve-icon MITRE

Status: PUBLISHED

Assigner: OCD

Published:

Updated: 2026-10-28T11:09:58.882Z

Reserved: 2026-10-28T10:57:30.594Z

Link: CVE-2026-118477

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')