CVE-2018-25332

Description

GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.

Overview

State

—

Assigner (CNA)

—

CVSS severity

critical

CVSS score

9.8 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Effective score

9.8 / 10 CRITICAL source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2018-25332

Linked Threat

CVE-2018-25332 — CVE-2018-25332

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-05-17 13:16:44 UTC

NVD last modified

2026-05-18 20:16:05 UTC

NVD CVSS v3.1

9.8 / 10 CRITICAL source: disclosure@vulncheck.com

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

3.9 / 10

Impact subscore

5.9 / 10

EPSS score

0.0027 (probability of exploitation in next 30 days)

EPSS percentile

50.40% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD-assigned CWE(s): CWE-306 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2018-21853

Assigner

VulnCheck

Published

May 17, 2026, 12:11:36 PM

Updated

May 18, 2026, 5:56:13 PM

EUVD base score (CVSS 4.0)

9.3 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EUVD-reported EPSS

0.2000

Vendors

gitbucket

Products

GitBucket (4.23.1)

Aliases

GHSA-5r94-357g-jqj4

ENISA description: GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload functionality. Attackers can brute-force the Blowfish encryption key, upload a malicious JAR plugin via the git-lfs endpoint, and execute system commands through an exposed exploit endpoint.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (7)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://github.com/gitbucket/gitbucket tenable:github.com
• https://nvd.nist.gov/vuln/detail/CVE-2018-25332 tenable:nvd.nist.gov
• https://security.szurek.pl/ tenable:security.szurek.pl
• https://www.cve.org/CVERecord?id=CVE-2018-25332 tenable:www.cve.org
• https://www.exploit-db.com/exploits/44668 tenable:www.exploit-db.com
• https://www.first.org/epss/ tenable:www.first.org
• https://www.vulncheck.com/advisories/gitbucket-unauthenticated-remote-code-execution tenable:www.vulncheck.com

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Security Advisory Bulletin 064 | Ubiquiti Community
  web:community.ui.com

  Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

  2026-05-26 02:57 UTC
• N-central third-party software patch list
  web:documentation.n-able.com

  For more information on how Patch Manager provides third-party patching, see Patching third-party software. Use the table's InstallerURLs location when configuring vendor and patch exclusions in your firewalls and other web-monitoring software.

  2026-05-26 02:57 UTC
• Security Update Guide - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-05-26 02:57 UTC
• ArcGIS Server Security 2025 Update 2 Patch - Esri Support
  web:support.esri.com

  BUG-000153493 - Installing ArcGIS Server Security 2022 Update 1 Patch or Update 2 Patch on ArcGIS Server 10.8.1 affects the access to existing Workflow Manager (Classic) feature services. BUG-000153438 - ArcGIS Server services folders become inaccessible in the REST endpoint if it has a dot (.) in the name and the Security patches are installed.

  2026-05-26 02:57 UTC
• Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE ...
  web:support.servicenow.com

  Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...

  2026-05-26 02:57 UTC
• Resolving Sweet32, Birthday Attacks on Windows Servers Via GPO
  web:www.experts-exchange.com

  In today's threat landscape, it is important to address vulnerabilities as fast as possible. Within Microsoft Active Directory environments, the fastest and best way to address these is through the use of GPO. This article will show how to address the Birthday\Sweet32 vulnerability via a GPO.

  2026-05-26 02:57 UTC
• 'Major Issues'—Microsoft Confirms Emergency Update For ... - Forbes
  web:www.forbes.com

  Microsoft update breaks Windows — emergency fix suddenly released and available now.

  2026-05-26 02:57 UTC
• Oracle Critical Patch Update Advisory - October 2025
  web:www.oracle.com

  This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.

  2026-05-26 02:57 UTC
• Microsoft fixes 167 security flaws in April, second biggest Patch ...
  web:www.pcworld.com

  This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

  2026-05-26 02:57 UTC
• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-26 02:57 UTC

Only Available for Registered Users. Sign in to view.