CVE-2026-73240— Apache Allura: Git command injection
Quick assessment
Affected
Apache Software Foundation Apache Allura
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Allura是美国Apache基金会开源的一个提供源代码管理与协作功能的项目托管平台。 Apache Allura 1.19.1之前版本存在命令注入漏洞，该漏洞源于特制输入可能导致git参数注入。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Allura | < 1.19.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73240
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Allura: Git command injection
Source: CVE Program / CVE List V5
Vulnerability Description
Specifically crafted inputs may lead to git argument injection in Apache Allura.
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Vulnerability Title
Apache Allura 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Allura是美国Apache基金会开源的一个提供源代码管理与协作功能的项目托管平台。 Apache Allura 1.19.1之前版本存在命令注入漏洞，该漏洞源于特制输入可能导致git参数注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Allura | 0 ~ 1.19.1 | - |
|
II. Public POCs for CVE-2026-73240
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73240
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-73240 (1)
Security Blog Posts for CVE-2026-73240 (1)
Same Patch Batch · Apache Software Foundation · 2026-08-12 · 17 CVEs total
| CVE-2026-68868 | Apache Airflow Google provider: google Secret Manager backend: team scope is never applied | |
| CVE-2026-68076 | Apache Airflow: Connections test API: team-scope guard bypass resolves another team's envi | |
| CVE-2026-68971 | Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run r | |
| CVE-2026-68970 | Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rende | |
| CVE-2026-68969 | Apache Airflow: Bulk Variable and Connection endpoints record secret values in the audit l | |
| CVE-2026-68968 | Apache Airflow: Authorization bypass in the Backfill API through conflicting interpretatio | |
| CVE-2026-65017 | Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi- | |
| CVE-2026-67587 | Apache Airflow: DAG-author remote code execution on the Scheduler via a Serde `Callback` d | |
| CVE-2026-67260 | Apache Airflow: DAG-author remote code execution on the Scheduler via awaiting_input next_ | |
| CVE-2026-54183 | Apache Airflow: Airflow Variables were not masked in the UI for authenticated users | |
| CVE-2026-59242 | Apache Airflow: Arbitrary airflow.* class instantiation on the API server via the XCom des | |
| CVE-2026-58076 | Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception node | |
| CVE-2026-59244 | Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Temp | |
| CVE-2026-73239 | Apache Allura: Missing permission checks IDOR | |
| CVE-2026-73238 | Apache Allura: XSS in code display | |
| CVE-2026-73237 | Apache Allura: XSS in markdown pipeline |
IV. Related Vulnerabilities
Same product: Apache Allura
-
CVE-2026-80190
Apache Allura: Stored XSS via code repositories -
CVE-2026-81270
Apache Allura: Information exposure via search -
CVE-2026-80181
Apache Allura: Server-side request forgery -
CVE-2026-80180
Apache Allura: Stored XSS via markdown HTML processing -
CVE-2026-75099
Apache Allura: Unauthenticated REST disclosure
Same vendor: Apache Software Foundation
-
CVE-2026-95616
Apache WSS4J: Unauthenticated denial of service via integer -
CVE-2026-92899
Apache WSS4J: UsernameToken replay protection bypassed by re -
CVE-2026-92121
Apache WSS4J: WS-SecurityPolicy signature checks skipped in -
CVE-2026-89238
Apache WSS4J: WSS4J EncryptedHeader child confusion causing -
CVE-2026-88920
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
Same weakness: CWE-88
-
CVE-2026-102904
JupyterLab: Argument injection in JupyterLab extension unins -
CVE-2026-100714
Froxlor before 2.3.12 Command Injection via letsencryptchall -
CVE-2026-100570
OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_ -
CVE-2026-100561
OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrap -
CVE-2026-100369
CliInvoke: Argument Injection in Extensibility Runner Factor
V. Comments for CVE-2026-73240
No comments yet