Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1:
- CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch
submitted twice triggers an add/add conflict that writes an executable
post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea
service account. Affects 1.17-1.27.0; public PoC.
- CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE
accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0),
escalating to RCE by reading config/tokens.
Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo
work; the previous branch predated it and was verified against a tree that would
not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR
convention (operator runs abra recipe release).
autonomic-bot