Critical severity · published May 17, 2026
CVE-2018-25332
GitBucket 4.23.1 Unauthenticated Remote Code Execution
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
GitBucket · gitbucket
4.23.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25332
Product
https://github.com/gitbucket/gitbucket
Not Applicable
https://security.szurek.pl/
Exploit
https://www.exploit-db.com/exploits/44668
Third Party Advisory
https://www.vulncheck.com/advisories/gitbucket-unauthenticated-remote-code-execution
More from GitBucket
6.3
CVE-2026-13540
GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery