"TL;DR: GNU Savannah hosts Bash, Coreutils, and hundreds of other GNU
projects. Using Hacktron, we found that an email address like
a`touch${IFS}/tmp/savane-rce-proof`@attacker.example gave any registered
user code execution on its backend. From there, we made our account a
superuser, impersonated Bash’s maintainer, and confirmed we could add an
SSH key with push access to the upstream Bash repository. An unpatched
kernel gave us root access and access to a GNU backup server. We
reported it to the FSF on May 11, 2026.
We then ran Hacktron’s pentest across the rest of Savane to find further
bugs and reported those too, bringing the total to 26 confirmed
vulnerabilities. The FSF fixed them and published an incident report.
[...]
Like much of the infrastructure free software depends on, [Savannah is]
run by a handful of volunteers and FSF staff with limited resources. We
wanted to put our resources to work there. Savannah runs Savane, a PHP
application that is itself free software, so we pointed Hacktron at the
source and audited it.
What came back is probably the most impactful bug we’ve ever found.
The bug: an email address that runs commands
Savane let us register with this email address:
a`touch${IFS}/tmp/savane-rce-proof`@attacker.example
You know where this is going, right? [...]"
https://www.hacktron.ai/blog/hacking-gnu-savannah
Regards,
Branden
signature.asc
Description: PGP signature
