You are viewing a plain text version of this content. The canonical link for it is here.

Posted to announce@apache.org by Dave Brondsema <br...@apache.org> on 2026/08/12 16:34:23 UTC

CVE-2026-73240: Apache Allura: Git command injection

Severity: important

Affected versions:

- Apache Allura before 1.19.1

Description:

Specifically crafted inputs may lead to git argument injection in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

References:

https://allura.apache.org/posts/2026-allura-1.19.1.html
https://allura.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-73240