Gitea Code Injection Vulnerability

Gitea Org-mode file disclosure and code execution

Gitea WebAuthn bypass during OAuth and OIDC sign-in

Gitea fork workflow approval bypass through maintainer-triggered events

Gitea before 1.17.3 does not sanitize and escape refs in the git backend

An Authentication Bypass vulnerability exists in Gitea before 1.5.0, which could let a malicious user gain privileges

An issue exsits in Gitea through 1.15.7, which could let a malicious user gain privileges due to client side cookies not being deleted and the session remains valid on the server…

Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API

Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in ParseRemoteAddr…

Gitea before 1.8.0 allows 1FA for user accounts that have completed 2FA enrollment

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs

Gitea OAuth2 refresh token grant accepts access tokens

Gitea review and execution mismatch through duplicate tree entries

Gitea built-in SSH server authentication bypass through key case folding

Gitea does not properly validate repository ownership when linking attachments to releases

Gitea does not properly validate repository ownership when deleting Git LFS locks

Gitea does not properly validate project ownership in organization project operations

Gitea reusable workflow secret exposure in pull_request_target

Gitea second-factor bypass through OpenID identity linking

Gitea fork workflow approval bypass through review events

Gitea fork workflow job revival through later approval

Gitea fork workflow approval bypass through cancel and rerun

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests

models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services

Gitea API token scope escalation through HTTP signatures

Gitea fork workflow approval bypass through concurrency cancellation

Gitea tag delete route deletes releases without release permission

Gitea installer authentication bypass for existing accounts

Gitea API team demotion not applied to unit permissions

Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea migration SSRF through ALLOWED_DOMAINS address check bypass

Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea SSH certificate principal impersonation of other users

Gitea external renderer argument injection and code execution

Gitea Actions memory exhaustion through large static matrices

Gitea denial of service through external issue tracker patterns

Gitea repository migration SSRF through DNS rebinding

Gitea SSRF through Git HTTP redirects in mirrors and fetches

Gitea trusted workflow cancellation by unapproved fork runs

Gitea does not properly verify repository context when deleting attachments

Gitea before 1.16.7 does not escape git fetch remote

An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file

Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL

Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path

An issue was discovered in Gitea through 1.11.5

Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is…

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress

The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g.,…

Gitea push mirror local path check uses the repository owner