GitBucket version 4.23.1 is vulnerable to unauthenticated remote code execution. The weakness stems from weak generation of secret tokens and an insecure file upload mechanism that allows an attacker to brute‑force the Blowfish encryption key used to protect uploads. By uploading a malicious JAR plugin through the git-lfs endpoint and leveraging an exposed exploit endpoint, an attacker can execute arbitrary system commands, compromising confidentiality, integrity, and availability of the affected host.

The issue affects GitBucket 4.23.1 as released by the vendor gitbucket. No other major versions are listed as affected in the supplied data.

A CVSS score of 9.3 marks this vulnerability as critical, and it is not listed in the CISA KEV catalog. The exploit requires no authentication and can be performed remotely via standard HTTP(S) calls to the GitBucket web interface, making it broadly exploitable for anyone with network access to the instance. No EPSS score is available, but the lack of authentication combined with the high severity suggests a high likelihood of exploitation.