← All advisories

Critical severity9.8NVD Advisory· Published Aug 12, 2026· Updated Aug 17, 2026

CVE-2026-73240

CVE-2026-73240

Description

Specifically crafted inputs may lead to git argument injection in Apache Allura.

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Apache/Allura2 versions
cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*range: <1.19.1
- (no CPE)range: <1.19.1

Patches

Vulnerability mechanics

References

3

www.openwall.com/lists/oss-security/2026/08/12/19nvdMailing ListThird Party Advisory
lists.apache.org/thread/10gnxblhomk2z4gxcyyb4t3p4zxsdddvnvdMailing ListVendor Advisory
allura.apache.org/posts/2026-allura-1.19.1.htmlnvdRelease Notes

News mentions

1

Apache Projects Hit by 25 Vulnerabilities in Coordinated August 2026 Disclosure
Vypr Intelligence · Aug 15, 2026