Gitea: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 10.0
  CVE-2024-6886 Scanner template EPSS 33%

  Inproper Sanitation of field leading to stored XSS

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.

  Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  Aug 6, 2024
• Medium 6.1
  CVE-2024-0406 Public exploit

  Mholt/archiver: path traversal vulnerability

  A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with…

  Red Hat Red Hat OpenShift Container Platform 4.18 Red Hat Advanced Cluster Security 4 Red Hat Advanced Cluster Security 3 Wolfi Go
  Apr 6, 2024

Revision history

1. 2025-12-14 #6

   Neue Updates von openSUSE aufgenommen

2. 2025-03-10 #5

   Neue Updates von Red Hat aufgenommen

3. 2024-08-28 #4

   PoC für CVE-2024-6886 aufgenommen

4. 2024-08-06 #3

   weitere Schwachstelle aufgenommen

5. 2024-08-05 #2

   CVE ergänzt

6. 2024-08-04 #1

   Initiale Fassung

References

• Gitea 1.22.1 Release Notes vom 2024-08-04
  https://blog.gitea.com/release-of-1.22.1
• GitHub vom 2024-08-04
  https://github.com/anchore/archiver/commit/82ca88a2eb24d418c30bf960ef071b0bbec04631
• GitHub Advisory Database
  https://github.com/advisories/GHSA-rhh4-rh7c-7r5v)
• PoC CVE-2024-6886 vom 2024-08-28
  https://www.exploit-db.com/exploits/52077
• Red Hat Security Advisory RHSA-2025:2449 vom 2025-03-11
  https://access.redhat.com/errata/RHSA-2025:2449
• openSUSE Security Update OPENSUSE-SU-2025-20160-1 vom 2025-12-14
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MFYZ3HG7DPJ2RPXJWKLM76LC5GTZIKYI/