CVE-2026-73294 in Semaphore
Summary
by MITRE • 08/12/2026
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in Semaphore UI represents a critical command injection flaw that enables attackers with project manager or owner privileges to execute arbitrary operating system commands on the Semaphore server. This security weakness stems from inadequate input validation and sanitization within the git_url parameter handling mechanism. The vulnerability manifests when the application processes repository URLs through the CmdGitClient.GetLastRemoteCommitHash method, which directly incorporates user-supplied git_url values into command execution without proper escaping or filtering of special characters.
The technical exploitation occurs through the POST /api/project/{id}/repositories endpoint where attackers can submit malicious git_url values containing specially crafted payloads. When these values are processed, they pass through the --upload-pack option to the underlying Git client commands, creating an environment where shell command injection becomes possible. The vulnerability is particularly dangerous because it requires only project-level privileges rather than administrative access, making it accessible to users who have been granted manager or owner roles within projects. This privilege escalation pathway allows attackers to execute arbitrary OS commands with the privileges of the Semaphore server process, potentially leading to full system compromise.
The operational impact of this vulnerability extends beyond simple command execution capabilities, as it provides attackers with persistent access to the underlying infrastructure and potential lateral movement opportunities. The scheduled commit-hash polling mechanism amplifies the attack surface by continuously processing user-controlled input without proper validation, creating multiple entry points for exploitation. This vulnerability directly maps to CWE-78, which addresses OS Command Injection, and aligns with ATT&CK technique T1059.001 for command and scripting interpreter. The flaw represents a classic case of insufficient input sanitization where user-controllable data flows directly into system commands without proper parameter escaping or context-aware filtering mechanisms.
Mitigation strategies should focus on implementing strict input validation and sanitization measures for all user-provided git_url parameters, including comprehensive filtering of special shell metacharacters and command separators. The application code must escape or quote all user-supplied values before incorporating them into system commands to prevent unintended command interpretation. Additionally, privilege separation mechanisms should be enforced where possible, limiting the execution context of Git operations to reduce potential impact from successful exploitation attempts. Regular security audits should validate that all external inputs are properly sanitized before processing, and implementation of a secure coding framework can help prevent similar issues in future development cycles while maintaining compliance with industry standards for secure software development practices.