CVE-2013-4490
GitLab <5.4.1, <6.2.3 - Command Injection
Title source: llmDescription
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands via shell metacharacters in the public key.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/34362
metasploit
WORKING POC
EXCELLENT
by Brandon Knight · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitlab_shell_exec.rb
Scores
EPSS
0.4978
EPSS Percentile
97.8%
Details
Status
published
Products (21)
gitlab/gitlab
5.0.0
gitlab/gitlab
5.0.1
gitlab/gitlab
5.1.0
gitlab/gitlab
5.2.0
gitlab/gitlab
5.3.0
gitlab/gitlab
5.4.0
gitlab/gitlab
6.0.0
gitlab/gitlab
6.1.0
gitlab/gitlab
6.2.0
gitlab/gitlab
6.2.1
... and 11 more
Published
May 13, 2014
Tracked Since
Feb 18, 2026