Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-13540: GitBucket can be tricked into making unauthorized network calls

CVE-2026-13540 · published 4 months ago

Summary

GitBucket versions up to 4.46.1 let a specially crafted URL cause the server to request any location it chooses. This could let remote attackers use your server to access internal resources or external sites. Apply the provided patch or upgrade to a newer version as soon as possible.

Original advisory text

GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery

A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The patch is named 487a9b980f56aa73b6a044b1e86a92eed5043215. To fix this issue, it is recommended to deploy a patch.

References

https://github.com/gitbucket/gitbucket/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13540... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-13540 Vendor Advisory
https://vuldb.com/cve/CVE-2026-13540 Vendor Advisory
https://vuldb.com/submit/836108 Vendor Advisory
https://vuldb.com/vuln/374548 Vendor Advisory
https://github.com/gitbucket/gitbucket/issues/4044 Third Party Advisory
https://vuldb.com/vuln/374548/cti Third Party Advisory
https://github.com/gitbucket/gitbucket/commit/487a9b980f56aa73b6a044b1e86a92eed5... Patch
https://github.com/gitbucket/gitbucket/pull/4056 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published29 Jun 2026

Updated4 Nov 2026

First seen29 Jun 2026

Sources

CVE-2026-13540 · NVD

CVE-2026-13540 · OSV

Track software like this

Free during beta