chore: upgrade gitea to 1.27.1-rootless

Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1:
- CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch
  submitted twice triggers an add/add conflict that writes an executable
  post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea
  service account. Affects 1.17-1.27.0; public PoC.
- CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE
  accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0),
  escalating to RCE by reading config/tokens.

Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo
work; the previous branch predated it and was verified against a tree that would
not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR
convention (operator runs abra recipe release).

This commit is contained in:

autonomic-bot

2026-08-10 16:27:26 +00:00

parent 37ebd22ba4

commit 096cc70fd9

1 changed files with 1 additions and 1 deletions

									
										compose.yml
									
		+1
		-1
	
												View File
												
				@@ -3,7 +3,7 @@ version: "3.8"

				services:

				  app:

				    image: "gitea/gitea:1.26.2-rootless"

				    image: "gitea/gitea:1.27.1-rootless"

				    configs:

				      - source: app_ini

				        target: /etc/gitea/app.ini