GNU Savane vulnerabilities

Latest GNU Savane CVEs

Newest publication first

1. CVE-2026-56355 GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.

   Published 2026-06-20

   Low·CVSS 3.7

   GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.

2. CVE-2024-29399 An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.

   Published 2024-04-11

   High·CVSS 7.6

   An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.

3. CVE-2024-27632 An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.

   Published 2024-04-08

   High·CVSS 8.8

   An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.

4. CVE-2024-27631 Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php

   Published 2024-04-08

   Medium·CVSS 6.0

   Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php

5. CVE-2024-27630 Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_data_delete_file function.

   Published 2024-04-08

   High·CVSS 7.5

   Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_data_delete_file function.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.