Gitea Remote Code Execution

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2019-11229 · ADVISORY
• go-gitea/gitea#6593 · WEB
• go-gitea/gitea#6595 · WEB
• go-gitea/gitea release v1.7.6 · WEB
• go-gitea/gitea release v1.8.0-rc3 · WEB
• exploit-db.com/exploits/49383 · WEB
• packetstormsecurity.com/files/160833/Gitea-1.7.5-Remote-Code-Execution.html · WEB
• GitHub Advisory GHSA-hpmr-prr2-cqc4 · ADVISORY

Lỗ hổng khác của github.com/go-gitea/gitea

• CVE-2026-25779TRUNG BÌNH 6.1Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.
• CVE-2026-20912NGHIÊM TRỌNG 9.1Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository c…
• CVE-2026-20904TRUNG BÌNH 6.5Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility s…
• CVE-2026-20897NGHIÊM TRỌNG 9.1Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to…
• CVE-2026-20888TRUNG BÌNH 4.3Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull req…