2534 matches found
SUSE CVE-2026-28705
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths...
EUVD-2026-66708
Gitea: Remote Code Execution via diffpatch Git Hook Installation...
Gitea: Remote Code Execution via diffpatch Git Hook Installation
Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...
GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation
Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...
Gitea: Remote Code Execution via diffpatch Git Hook Installation
Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain th...
CVE-2026-58443
A flaw was found in Gitea. This vulnerability allows an attacker to use tokens intended for public repositories to modify private pull request PR branches. This could lead to unauthorized changes in private code, compromising the integrity of the affected repositories. Mitigation Update to Gitea...
CICD-Goat-Vapt-Writeup — Updated!
CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. 🧭 How This Fits With My Other Repos Repository| What's in...
GO-2026-6338 Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea
Gitea repository creation accepts insufficiently validated fields in code.gitea.io/gitea...
GO-2026-6334 Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea
Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea...
GO-2026-6333 Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea
Gitea organization permission APIs expose hidden membership and private organization data in code.gitea.io/gitea...
GO-2026-6341 Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea
Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea...
GO-2026-6339 Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea
Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea...
GO-2026-6340 Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea
Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea...
GO-2026-6342 Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea
Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea...
GO-2026-6337 Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea
Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea...
GO-2026-6335 Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea
Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea...
GO-2026-6336 Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea
Gitea OAuth2 authorization codes can be reused after expiry in code.gitea.io/gitea...
ROS-20260902-73-0023
The vulnerability in Gitea is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the Git repository management system Gitea, related to insufficient validation of server-side requests, allows a hacker to execute a SSRF attack.
The vulnerability of the Git repository management system Gitea is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform a SSRF attack remotely...