OS Command Injection Vulnerability in KaliFast by Kali Linux
CVE-2026-118477

8.7HIGH

Key Information:

Vendor

Eisge

Status
Kalifast
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118477?

An OS Command Injection vulnerability exists in the 'ei_git_repo_url' parameter of the Git remote configuration endpoint in KaliFast. This flaw allows authenticated attackers, who can create a free account, to execute arbitrary commands on the server running KaliFast with 'www-data' privileges, potentially compromising the integrity and confidentiality of the server. Users are advised to upgrade to version 2026061802 or later to safeguard against these security risks.

Affected Version(s)

Kalifast 0 < 2026.02.1

Kalifast 2026.02.1

References

https://advisories.orangecyberdefense.com/advisories/166
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Evariste Gwanulaga - Pentester from Orange Cyberdefense France
.