GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token ge…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 17, 2026 · NIST NVD

   Detected

   GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.

2. Jun 17, 2026 · NIST NVD

   Updated

   GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.

Affected

• cpe gitbucket/gitbucketversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2018-25332

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2018-25332

  GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a

  nvd.nist.gov

References

• Product · github.com
• Not Applicable · security.szurek.pl
• Exploit · exploit-db.com
• Third Party Advisory · vulncheck.com