Summary
Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
Product
Gitea ist ein quelloffener Github-Klon.
Vulnerabilities 15
-
Critical 9.8
Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
-
Critical 9.1
Gitea repository creation accepts invalid field values
Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.
-
Critical 9.1
Gitea template repository generation mishandles symlinked paths
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
-
Critical 9.1
Gitea OAuth2 authorization codes lack expiry and reuse enforcement
Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single-use behavior during token exchange.
-
Critical 9.1
Gitea OAuth2 PKCE S256 challenges are not enforced during token exchange
Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctly during authorization, allowing token exchange without the expected verifier check.
-
High 7.5
Gitea pull-request branch updates use insufficient permission checks
Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.
-
High 7.5
Gitea organization permission APIs expose private visibility information
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
-
High 7.5
Gitea git grep search lacks a timeout
Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.
-
High 7.5
Gitea email settings allow changing another user's primary email address
Gitea versions before 1.25.5 allow a user to change another user's primary email address.
-
High 7.5
Gitea draft releases use insufficient permission checks
Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.
-
High 7.5
Gitea forwarded-proto handling allows public URL spoofing
Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.
-
Medium 6.1
Gitea redirect handling permits open redirects through backslash paths
Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.
-
Medium 5.3
Gitea tracked-time list endpoint has insufficient permission checks
Gitea versions before 1.25.5 have insufficient permission checks when listing tracked time entries.
-
Medium 5.3
Gitea tracked-time deletion can target entries from another issue
Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to target entries from another issue.
-
Medium 5.3
Gitea repository dumps write release assets using unsafe path names
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
Revision history
-
#3
Referenz(en) aufgenommen: GHSA-7JVX-G65V-R899
-
#2
Referenz(en) aufgenommen: EUVD-2026-41641, EUVD-2026-41637, EUVD-2026-41633, EUVD-2026-41630, EUVD-2026-41631, EUVD-2026-41632, EUVD-2026-41629, EUVD-2026-41624, EUVD-2026-41626, EUVD-2026-41622, EUVD-2026-41620, EUVD-2026-41616, EUVD-2026-41615, EUVD-2026-41628, EUVD-2026-41625
-
#1
Initiale Fassung
References
-
Gitea Advisory vom 2026-03-16
https://blog.gitea.com/release-of-1.25.5/