From 096cc70fd9c45dbe0e802c6dee718d8967b5e7fd Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 10 Aug 2026 16:27:26 +0000 Subject: [PATCH] chore: upgrade gitea to 1.27.1-rootless MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1: - CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch submitted twice triggers an add/add conflict that writes an executable post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea service account. Affects 1.17-1.27.0; public PoC. - CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0), escalating to RCE by reading config/tokens. Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo work; the previous branch predated it and was verified against a tree that would not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR convention (operator runs abra recipe release). --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 93148a7..675d168 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "gitea/gitea:1.26.2-rootless" + image: "gitea/gitea:1.27.1-rootless" configs: - source: app_ini target: /etc/gitea/app.ini -- 2.54.0