CVE-2026-73240CWE-88

CVE-2026-73240

Critical · published August 12, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
63.8
In the wild
Unconfirmed
What it is

Specifically crafted inputs may lead to git argument injection in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01043 · 63.8th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-08-12T21:17Z
Affected products (1)
ProductVersionsFixed in
apache/allura< 1.19.11.19.1
References (3)
https://allura.apache.org/posts/2026-allura-1.19.1.html · [email protected]https://lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddv · [email protected]http://www.openwall.com/lists/oss-security/2026/08/12/19 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 AUG 16:41Z
    Apache Allura: Git command injection
    cvelistv5