coop-cloud/gitea
3
1
Fork 7
Code Issues 7 Pull Requests 3 Releases Wiki Activity

chore: upgrade gitea to 1.27.1-rootless #61

Merged
notplants merged 1 commits from upgrade-7561bed into master 2026-08-10 16:32:05 +00:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
notplants commented 2026-08-10 16:31:52 +00:00
Owner
Copy Link
Copy Source

Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1:

  • CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch
    submitted twice triggers an add/add conflict that writes an executable
    post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea
    service account. Affects 1.17-1.27.0; public PoC.
  • CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE
    accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0),
    escalating to RCE by reading config/tokens.
Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1: - CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch submitted twice triggers an add/add conflict that writes an executable post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea service account. Affects 1.17-1.27.0; public PoC. - CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0), escalating to RCE by reading config/tokens.
notplants added 1 commit 2026-08-10 16:31:53 +00:00
chore: upgrade gitea to 1.27.1-rootless 096cc70fd9 
Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1:
- CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch
  submitted twice triggers an add/add conflict that writes an executable
  post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea
  service account. Affects 1.17-1.27.0; public PoC.
- CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE
  accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0),
  escalating to RCE by reading config/tokens.

Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo
work; the previous branch predated it and was verified against a tree that would
not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR
convention (operator runs abra recipe release).
notplants merged commit a8d2231e74 into master 2026-08-10 16:32:05 +00:00
notplants deleted branch upgrade-7561bed 2026-08-10 16:32:05 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
3wordchant aadil (Aadil Ayub) abra-bot (Abra Bot) ammaratef45 amras (Sarma) Apfelwurm appletalk arjan basebuilder BornDeleuze Brooke carla cas (Cassowary) codegod100 coopcloud cyrnel decentral1se (d1) dede devydave fauno (fauno) flancian Frando iexos jade (Jade Ambrose) javielico (Javielico) jjsfunhouse jmakdah2 (Jackie Makdah) joe-irving (Joe Irving) kawaiipunk (KawaiiPunk) knoflook kolaente lambdabundesverband linnealovespie (April) marlon (marlon) mayel mirsal moosemower moritz nicksellen (Nick Sellen) notplants oxaliq (sorrel) p4u1 pau pharaohgraphy (Andrew 🐦‍🔥❤️‍🔥✴️) PhiNatalie renovate-bot (Comrade Renovate Bot) ripclap rix rscmbbng sef (sef) simon sixsmith (Sixsmith) stevensting tobias trav (Trav Fryer) val (val (he/him)) vaznasty virtualboys wolcen (Chris Thompson) wykwit xynosis yksflip
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coop-cloud/gitea#61