GNU Savane vulnerabilities

5 CVEs affecting GNU Savane, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-56355, published 2026-06-20.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-27632, published 2024-04-08. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.
• CVE-2024-29399, published 2024-04-11. High severity, CVSS 7.6. EPSS: 0.9% chance of exploitation in the next 30 days. An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.
• CVE-2024-27630, published 2024-04-08. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackers_data_delete_file function.
• CVE-2024-27631, published 2024-04-08. Medium severity, CVSS 6.0. EPSS: 0.4% chance of exploitation in the next 30 days. Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php
• CVE-2026-56355, published 2026-06-20. Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days. GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.