37 matches found
VulnCheck KEV: CVE-2026-59774
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-59774
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-59774
Gitea versions 1.22.1 through 1.27.0 are vulnerable to an unauthenticated arbitrary file read flaw. The issue exists because the Org-mode markup renderer fails to override the default ReadFile callback in the go-org library. An attacker can submit Org-mode markup containing an #+INCLUDE directive...
CVE-2026-59774 Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-59774 Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
FreeBSD: VID-f4af92f7-95ae-11f1-a6f7-b42e991fc52e (CVE-2026-59774): gitea -- Multiple vulnerabilities
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
CVE-2026-59774: Improper Limitation of a Pathname to a Restricted Directory
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...
PYSEC-2026-3785
GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...
CVE-2026-78675
GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...
PYSEC-2026-3785
GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...
CVE-2026-78675
GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...
CVE-2026-78675 GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...
CVE-2026-78675 GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...
CVE-2026-78675 GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...
CVE-2026-78675
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, enabling a local file content disclosure attack. An attacker who can place a malicious .gitmodules file in a repository can craft [include] directives pointing to sensitive local files. When repo.submodules is acces...
JLSEC-2026-1237
A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may...
PT-2026-81150
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An issue exists when parsing .gitmodules files where the software fails to disable merge includes. This allows an attacker to disclose the content of local files by using include directives to poi...
GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...
CVE-2026-47179
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because...
CVE-2026-47179 Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before any path-traversal validation runs. Because...