CVE-2026-13540
GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jun 29, 2026
- Updated
- Jun 29, 2026
- Reserved
- Jun 28, 2026
Description
A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The patch is named 487a9b980f56aa73b6a044b1e86a92eed5043215. To fix this issue, it is recommended to deploy a patch.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
- CWE-918 Server-Side Request Forgery
Affected Products
| Product | Versions |
|---|---|
GitBucketn/a |
|
References
- VDB-374548 | GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgeryvdb-entrytechnical-description
- VDB-374548 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-13540 | CVE Analysis and Reportthird-party-advisory
- Submit #836108 | gitbucket 4.46.1 Server-Side Request Forgerythird-party-advisory
- https://github.com/gitbucket/gitbucket/issues/4044exploitissue-tracking
- https://github.com/gitbucket/gitbucket/pull/4056issue-trackingpatch
- https://github.com/gitbucket/gitbucket/commit/487a9b980f56aa73b6a044b1e86a92eed5043215patch
- https://github.com/gitbucket/gitbucket/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.