KaliFast Git Remote Configuration OS Command Injection Vulnerability

The KaliFast Git remote configuration endpoint is vulnerable to OS Command Injection through the ei_git_repo_url parameter. This allows an authenticated attacker to execute arbitrary commands on the KaliFast server with www-data privileges.

Free registration is available, so an attacker can create an account to reach the vulnerable endpoint. The vulnerability is fixed in version 2026061802.

• Authentication required, but free registration is available
• Impact: arbitrary command execution with www-data privileges
• Fixed in version 2026061802