CVE-2018-1000533: GitList searchTree input validation flaw allows PHP code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, combined with a very high EPSS score and public exploit references, makes this an urgent remote code execution risk.

What it is

GitList version 0.6 and earlier passes incorrectly sanitized input from the search form into a system function in the searchTree routine. An unauthenticated remote attacker can send a crafted POST request to execute arbitrary code as the PHP user. The issue is fixed in 0.7 via commit 87b8c26b023c3fc37f0796b14bb13710f397b322.

Impact

Successful exploitation gives the attacker arbitrary code execution with the privileges of the PHP process, leading to full compromise of the GitList host and any repositories it serves.

Attack surface

Reached over the network through the GitList search form by sending a POST request; the CVSS vector shows no authentication (PR:N) and no user interaction (UI:N) required.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.72967, 99.4th percentile) and public references include an exploit write-up, indicating meaningful real-world exploitation risk.

What to do

• Upgrade GitList to 0.7 or later, which contains the fix from commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
• If immediate upgrade is not possible, restrict network access to GitList instances to trusted users or place them behind authentication and network controls.
• Run the PHP process under a low-privilege account with no unnecessary filesystem or shell access.
• Review and harden any custom code paths that pass user input to system or shell functions, applying strict allowlist validation.
• Monitor GitList and PHP logs for anomalous search requests containing shell metacharacters.

Detection

• Inspect web server and application logs for POST requests to GitList search endpoints containing shell metacharacters such as ;, |, $(), backticks, or &&.
• Monitor for unexpected child processes spawned by the PHP process (for example sh, bash, curl, wget) on GitList hosts.
• Alert on outbound network connections from the GitList server to unfamiliar hosts, which may indicate post-exploitation activity.
• Use file integrity monitoring on web-accessible directories to detect dropped webshells or modified PHP files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.