GHSA-cv5c-2qv5-w2m2
Passbolt Api Remote code execution
Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code.
The impact is very high, but the probability is very low given that this vulnerability can only be exploited during Passbolt’s installation stage.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
Passbolt Api Remote code execution
Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code.
The impact is very high, but the probability is very low given that this vulnerability can only be exploited during Passbolt’s installation stage.
- Record
GHSA-cv5c-2qv5-w2m2- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
Passbolt Api Remote code execution
Passbolt provides a way for system administrators to generate a PGP key for the server during installation. The wizard requests a username, an e-mail address and an optional comment. No escaping or verification is done by Passbolt, effectively allowing a user to inject bash code.
The impact is very high, but the probability is very low given that this vulnerability can only be exploited during Passbolt’s installation stage.
- Record
GHSA-cv5c-2qv5-w2m2- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
passbolt/passbolt_apiPackagist | before 2.7.0 | 2.7.0 |
passbolt/passbolt_apiPackagist | before 2.7.0, plus listed versions v1.0.10v1.0.11v1.0.12v1.0.13v1.0.14 Show 40 moreShow lessv1.0.5v1.0.6v1.0.7v1.0.8v1.0.9v1.1.0v1.2.0v1.2.1v1.3.0v1.3.1v1.3.2v1.4.0v1.5.1v1.6.0v1.6.1v1.6.10v1.6.2v1.6.3v1.6.4v1.6.5v1.6.9v2.0.0v2.0.0-rc1v2.0.0-rc2v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.7v2.0.8v2.1.0v2.1.1v2.2.0v2.3.0v2.4v2.5.0v2.5.1v2.6.0v2.6.1 | 2.7.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-cv5c-2qv5-w2m2 is a high vulnerability (CVSS 8.1) in passbolt/passbolt_api, published May 20, 2024. No source lists public exploit code. Fixed in passbolt/passbolt_api 2.7.0.
References
github.com/passbolt/passbolt_api/commit/be84671676ebac43d49e326a14f1afe259777611
passbolt.com/incidents/20190211_multiple_vulnerabilities