CVE-2026-73294

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.

• CWE-78
• CWE-88

• https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6
• https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacf
• https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p
• https://github.com/semaphoreui/semaphore/tree/v2.18.17
• https://github.com/semaphoreui/semaphore/tree/v2.19.5-beta2

Published

Aug 12, 2026

Last Modified

Aug 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73289RustFS is a distributed object storage system built in Rust.…8.1
• CVE-2026-7329An improper privilege management vulnerability in the SQL, S…9.9
• CVE-2026-73290RustFS is a distributed object storage system built in Rust.…5.3
• CVE-2026-73291Seerr is an open-source media request and discovery manager …7.1
• CVE-2026-73292Semaphore UI is a web interface for managing DevOps tools. P…8.3
• CVE-2026-73293Semaphore UI is a web interface for managing DevOps tools. …8.8
• CVE-2026-7330The Auto Affiliate Links plugin for WordPress is vulnerable …7.2
• CVE-2026-7332The LatePoint – Calendar Booking Plugin for Appointments and…7.2
• CVE-2026-73325Fujitsu Research's OneCompression library 1.2.0 contains an …7.8
• CVE-2026-7333Use after free in GPU in Google Chrome prior to 147.0.7727.1…9.6
• CVE-2026-7334Use after free in Views in Google Chrome on Mac prior to 147…8.8
• CVE-2026-7335Use after free in media in Google Chrome prior to 147.0.7727…8.8