CVE-2026-82669: klaussilveira GitList XML Parsing CommandLine.php SimpleXMLElement denial of service

Published Aug 31, 2026

Updated

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of the file src/SCM/System/Git/CommandLine.php of the component XML Parsing. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.0.0-beta can resolve this issue. The patch is named f67609d52c1812fa8a7ed80eae5e795cfd72115f. It is advisable to upgrade the affected component.

Affected Software

1 affected component

klaussilveira GitList=2.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade klaussilveira GitList to a version that resolves this vulnerability.
Fixed in 3.0.0-betaPatch f67609d52c1812fa8a7ed80eae5e795cfd72115f

Event History

Aug 31, 2026

CVE Published

via MITRE·09:15 AM

Data Sourced

via MITRE·09:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The attack can be carried out remotely and requires no privileges or user interaction according to the supplied vector. Public exploit code is available, which increases the likelihood of exploitation attempts.

Which deployments are affected?

GitList version 2.0.0 is identified as affected. The issue is in XML parsing through SimpleXMLElement in src/SCM/System/Git/CommandLine.php.

What is the recommended remediation?

Upgrade the affected component to GitList 3.0.0-beta. The identified patch is f67609d52c1812fa8a7ed80eae5e795cfd72115f.