CVE-2026-96580

概要

参考情報

• blog.gitea.com/release-of-28.0.0 · Release Notes
• go-gitea/gitea#39295 · Patch
• go-gitea/gitea release v28.0.0 · Release Notes
• go-gitea/gitea security advisory · Vendor Advisory

gitea のその他の脆弱性

• CVE-2026-97208中 4.9The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabl…
• CVE-2026-96594中 6.1The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not i…
• CVE-2026-89182中 5.4With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.priva…
• CVE-2026-86684高 7.1The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instance…
• CVE-2026-105268中 4.3The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments …