CVE-2018-25332
published 2026-05-17CVE-2018-25332: GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.59%
43.7th percentile
GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitbucket | gitbucket | < 4.24.0 | 4.24.0 |
| gitbucket | gitbucket | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GitBucket 4.23.1 JAR missing authentication (Exploit 44668 / EUVD-2018-21853)
vuldb·2026-05-17·CVSS 9.3
CVE-2018-25332 [CRITICAL] GitBucket 4.23.1 JAR missing authentication (Exploit 44668 / EUVD-2018-21853)
A vulnerability classified as critical has been found in GitBucket 4.23.1. Affected by this vulnerability is an unknown functionality of the component JAR Handler. Performing a manipulation results in missing authentication.
This vulnerability is cataloged as CVE-2018-25332. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
GHSA
GHSA-5r94-357g-jqj4: GitBucket 4
ghsa_unreviewed·2026-05-17
CVE-2018-25332 [CRITICAL] CWE-306 GHSA-5r94-357g-jqj4: GitBucket 4
GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-17
Published