Git Argument Injection Vulnerability in Apache Allura by Apache
CVE-2026-73240

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Allura
Vendor
CVE Published:
12 August 2026

What is CVE-2026-73240?

A vulnerability in Apache Allura allows for git argument injection due to improperly handled inputs. This can lead to unintended command execution on the server. Affected users are advised to upgrade to version 1.19.1 to mitigate this vulnerability and enhance the security of their systems.

Affected Version(s)

Apache Allura 0 < 1.19.1

References

https://allura.apache.org/posts/2026-allura-1.19.1.html
https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4...
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.