An email address on GNU Savannah opened a path to code on the server

The Hacktron team published an analysis on 30 October 2026 of an attack on GNU Savannah, a site hosting repositories for Bash, Coreutils and hundreds of other GNU projects. A flaw in Savane, the PHP application that runs the forge, allowed any registered user to execute their own code on the server. The researchers reported the vulnerability to the FSF on 11 May 2026: the organization closed 26 issues and published an incident report.

An email address as a command

The mechanism turned out to be simple. Savane's address validator accepted backticks, the dollar sign, curly braces, a slash and the vertical bar in the local part: the RFC allows such characters in an address. An address with a command inside passed registration or an email change. After that it was enough to open the GPG key check page and press the test button: Savane substituted the address into the gpg command line, and proc_open with a single string passes it to /bin/sh. The shell executed the nested command before gpg started. The space was bypassed via ${IFS}, because the validator did not allow it.

The vulnerable path appeared in Savane release 3.17-c369 of 7 March 2026 and affected savannah.gnu.org and savannah.nongnu.org, so the window was about two months. From the resulting web shell, the researchers read the Savane configuration with the database credentials, set the superuser flag on their account and refreshed the page.

The superuser panel has a "Become this user" block that allows acting on behalf of any account without a password. The researchers entered chet and landed on the SSH keys page of Chet Ramey, the Bash maintainer, where an empty slot remained. Savannah's Git hosting is tied to these records, so an added key would have given the right to write to the Bash upstream. They did not add a key and did not touch the repository; the report notes that in such a position an attacker could push a commit under the maintainer's name, and the same applies to Coreutils and other projects.

The kernel, root and a backup server

The kernel played a separate role. Savannah runs on Trisquel GNU/Linux 11 with linux-libre built from the 5.15 LTS of Ubuntu 22.04, and that kernel remained vulnerable to two OverlayFS bugs from 2023, CVE-2023-2640 and CVE-2023-32629, known as GameOver(lay). For 5.15 the fix came in USN-8255-1 on 7 May 2026, four days before the report. A public exploit worked on the first try and gave root on the backend. Already as root, the researchers found a key that could be used to log in over SSH to the GNU backup host as the user gnubackup.

After the first report, Hacktron ran an audit across the entire Savane codebase, which descends from SourceForge of 2001. The tool produced 33 findings, 7 were discarded as false positives, and 26 went to the FSF: 2 critical, 6 high, 16 medium and 2 low, with file paths, line numbers and reproduction steps. Among them were an authorization bypass in the configuration of the site admin group, the ability for any group member to delete its mailing lists, changing tracker notification addresses and XSS via the real name field.

Savannah administrator Corwin Brust replied the same night. The FSF treated the report as a full compromise: the kernel was updated, access rights, databases and logs were checked, and the operator of another public Savane installation was warned. On 14 May 2026 the organization installed the fixed kernel and deleted the researchers' account. On 19 June the FSF statement came out, and on 7 August 2026 the incident report and Savane patches were published. The code hosted on Savannah then spreads to distributions and ends up on millions of machines, and a few volunteers and FSF staff keep this infrastructure running.

Image: VectorVoyager CC BY-SA 4.0 · License

Translation editors: Соловьев В., Пеков А.