CVE-2026-95112

Mô tả

Tham khảo

• blog.gitea.com/release-of-28.0.0 · Release Notes
• go-gitea/gitea#39396 · Patch
• go-gitea/gitea release v28.0.0 · Release Notes
• go-gitea/gitea security advisory · Vendor Advisory

Lỗ hổng khác của gitea

• CVE-2026-97208TRUNG BÌNH 4.9The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabl…
• CVE-2026-96594TRUNG BÌNH 6.1The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not i…
• CVE-2026-89182TRUNG BÌNH 5.4With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.priva…
• CVE-2026-86684CAO 7.1The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instance…
• CVE-2026-105268TRUNG BÌNH 4.3The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments …