All vulnerabilities
CVE-2026-118477

KaliFast Project Management Platform ei_git_repo_url OS Command Injection

EISGE Kalifast
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2026.02.1Fixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.

Text from CVE List

Affected versions 2

  • Kalifastaffected: all versions before 2026.02.1CVE List
  • Kalifastunaffected: 2026.02.1CVE List

References 1