PT-2026-72121

CVE-2026-73682

Published

2026-08-14

Updated

2026-09-10

Description by

CVSS 3.1

9.9

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20

Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by crafting a malicious git url value using the --upload-pack= option. This occurs when the server processes repository operations using the default cmd git client.

Recommendations Update Semaphore to version 2.18.20 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Faran Abdullah

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-88: Improper Neutralization of Argument Delimiters in a Command (\'Argument Injection\')