EISGE Kalifast: OS command injection in Git remote configuration
Summary
The ei_git_repo_url parameter in the Git remote configuration endpoint of Kalifast (also written KaliFast) does not sanitize user input before passing it to the operating system. An authenticated attacker can run arbitrary commands on the server with www-data privileges. Registration is reportedly free, so an internet-facing instance with open registration is reachable by anyone who can access its login page.
Affected
- Kalifast before 2026.02.1 (CNA data, VulDB: up to 2026.02.0)
- Exact affected range to be confirmed with the vendor, see fixed version
Fixed in
- Upgrade to 2026061802 (per CVE description)
- Conflict: CNA data and VulDB name 2026.02.1 as the first unaffected version. Confirm the fixed build with EISGE or Orange Cyberdefense.
Workaround
- No vendor-published workaround known.
- Restrict access to the Git configuration pages to trusted networks or VPN until upgraded.
- Disable or restrict self-registration.
- Rotate application accounts and credentials.
- Review logs and Git remote settings for unexpected values.
Exploitation
- No confirmed exploitation known.
- CISA KEV: No.
- One aggregator reports no confirmed public exploit code.
- A separate KaliFast CVE (CVE-2025-18427) in the same feature is reported as exploited in the wild, unverified.
Our recommendation
- Identify all Kalifast instances and check whether they are internet-facing.
- Confirm the exact fixed build with EISGE or Orange Cyberdefense before patching decisions.
- Upgrade internet-facing instances first.
- Restrict or disable open registration and apply the interim measures above.
- Monitor logs for unusual commands or Git configuration changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Orange Cyberdefense Security Advisory 166 advisories.orangecyberdefense.com
- VulDB 427837 vuldb.com
- CVE record (CVEProject cvelistV5) raw.githubusercontent.com
- CVE-2026-118477 mirror (threatint) cve.threatint.com
- CVE-2026-118477 Strix www.strix.ai
- CVE-2026-118477 TheHackerWire www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:47.
Original description (NVD)
The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection vulnerability allows an authenticated attacker (free registration available) to execute arbitrary commands on the KaliFast server with www-data privileges. Fixed in version 2026061802.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.