Gitea Cross-site Scripting Vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-6886 · ADVISORY
• go-gitea/gitea#31200 · WEB
• go-gitea/gitea commit b6280f4 · WEB
• blog.gitea.com/release-of-1.22.1 · WEB
• go-gitea/gitea · PACKAGE
• pkg.go.dev/vuln/GO-2024-3056 · WEB
• blog.gitea.com/release-of-1.22.1
• GitHub Advisory GHSA-4h4p-553m-46qh · ADVISORY

code.gitea.io/gitea のその他の脆弱性

• CVE-2026-59766中 4.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated wi…
• CVE-2026-60004緊急 9.8悪用確認済み（CISA KEV）Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
• CVE-2026-59763中 4.3Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
• CVE-2026-58511低 2.7Webhook Authorization Header Returned in Plaintext via API
• CVE-2026-58510中 4.3GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private