Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Summary The web handler EditReleasePost routers/web/repo/release.go reads form fields with prefix attachment-edit-uuid into a mapuuidnewName, passes that map to releaseservice.UpdateRelease, which writes the new name to the database via repomodel.UpdateAttachmentByUUID WITHOUT calling upload.Veri...

PT-2026-63293

Name of the Vulnerable Software and Affected Versions Gitea versions 1.22.x and earlier Description A Local File Inclusion issue exists in the restore-repo command when processing release.yml files from user-supplied archives. The DownloadURL field in release attachments is passed to the uri.Open...

PT-2026-63296

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.1 Description A user with repository write permissions can bypass the configured file extension allowlist when renaming release attachments via the web interface. While the API endpoints enforce the...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Gitea's restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open without scheme validation. Because uri.Open supports the file:// scheme via os.Open, an operator-level attacker can plant a crafted...

GHSA-FC3H-92P8-H36F Unauthenticated File Upload in Gogs

Security Advisory:Unauthenticated File Upload in Gogs Vulnerability Type: Unauthenticated File Upload Date: Aug 5, 2025 Discoverer: OpenAI Security Research Summary Gogs exposes unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled default, any...

GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea...

BIT-GITEA-2026-20912 Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

Gitea does not properly validate repository ownership when linking attachments to releases

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

CVE-2026-20912

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

CVE-2026-20912 Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

CVE-2026-20912 Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

CVE-2026-20912 Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users...

PT-2026-4294

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The software does not correctly check ownership of repositories when managing attachments linked to releases. This can lead to a situation where an attachment from a private repository is...