CVE-2018-1000533
CVSS v3
9.8
CRITICAL
EPSS Score
73.0 %
exploit probability, as of 2026-10-05
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
Technical details
- Published
- 2018-06-26
Frequently asked questions
What is CVE-2018-1000533?
klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result in Execute any code as PHP user. This attack appear to be exploitable via Send POST request using search form. This vulnerability appears to have been fixed in 0.7 after commit 87b8c26b023c3fc37f0796b14bb13710f397b322.
Is CVE-2018-1000533 actively exploited?
Active exploitation of CVE-2018-1000533 has not been confirmed. Its EPSS score was 73.0% on 2026-10-05, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2018-1000533?
CVE-2018-1000533 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2018-1000533 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 50 free checks/month · Free API key
Other 2018 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).