CVE-2026-56657

creationtimestamp| type| source ---|---|--- 2026-07-21 22:35:25+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-4xjf-493q-98p3...

Improper Protection of Alternate Path

Overview Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to insufficient validation in attachment editing APIs. An attacker can upload files with restricted extensions by modifying the attachment name, leading to unauthorized file uploads and further...

FreeBSD : gitea -- multiple vulnerabilities (453cd84e-bca4-11ef-8926-9b4f2d14eb53)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 453cd84e-bca4-11ef-8926-9b4f2d14eb53 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's...

gitea -- Fix misuse of PublicKeyCallback

Problem Description: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto...

FreeBSD : gitea -- Prevent anonymous container access (bd7592a1-cbfd-11ee-a42a-5404a6f3ca32)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bd7592a1-cbfd-11ee-a42a-5404a6f3ca32 advisory. - Even with RequireSignInView enabled, anonymous users can use docker pull to fetch public images...

Design/Logic Flaw

Gitea before 1.16.7 does not escape git fetch remote...

Directory traversal

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL...

CVE-2021-45330

An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server side for reuse...

CVE-2021-45328

Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site 'Open Redirect' via internal URLs...

CVE-2020-28991

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines with URL encoding in ParseRemoteAddr in modules/auth/repoform.go...