CVE-2026-105268

Mô tả

Tham khảo

• blog.gitea.com/release-of-28.1.0 · Release Notes
• go-gitea/gitea#39501 · Patch
• go-gitea/gitea#39507 · Patch
• go-gitea/gitea release v28.1.0 · Release Notes
• go-gitea/gitea security advisory · Vendor Advisory

Lỗ hổng khác của gitea

• CVE-2026-97208TRUNG BÌNH 4.9The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabl…
• CVE-2026-96594TRUNG BÌNH 6.1The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not i…
• CVE-2026-89182TRUNG BÌNH 5.4With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.priva…
• CVE-2026-86684CAO 7.1The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instance…
• CVE-2026-105267CAO 8.1The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handl…