The vulnerability is a git argument injection flaw in Apache Allura that allows specially crafted input to be executed as part of a git command. This flaw can result in arbitrary code execution on the server, compromising confidentiality, integrity, and availability, and is identified as CWE‑88.

Apache Allura installations running any version prior to 1.19.1 are affected; the vendor is the Apache Software Foundation.

The CVSS score of 9.8 indicates a high severity. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, but the impact is high due to the potential for remote code execution. The likely attack vector, inferred from the description, involves supplying malicious input, such as a specially crafted repository URL or other git‑related parameter, that is unsanitized and passed directly to a git command. Exploitation would require the attacker to supply such input through the web interface or API, and would succeed if the system executes the injected command with sufficient privileges.