https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:00:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352804 EUVD-2026-352804 https://cve.radiocsirt.org/vuln/euvd-2026-352804 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58420 <p>Local File Inclusion via file:// URI in Migration Restore</p> <p>Local File Inclusion via file:// URI in Migration Restore</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58420 https://cve.radiocsirt.org/vuln/ghsa-5ggr-2f2h-jmvm <p><strong>Affected:</strong> Go: gitea.dev</p> <p># Local File Inclusion via file:// URI in Migration Restore</p> <p>Target: go-gitea/gitea Component: services/migrations/gitea_uploader.go, modules/uri/uri.go Severity: High Affected Versions: &lt;= v1.22.x (all releases), master as of latest commit Researchers: - Isa Can — Eresus Security (https://github.com/isa0-gh) - Yigit Ibrahim — Eresus Security (https://github.com/ibrahmsql)</p> <p>---</p> <p>## Summary</p> <p>Gitea&#39;s restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open() without scheme validation. Because uri.Open() supports the file:// scheme via os.Open(), an operator-level attacker can plant a crafted release.yml to exfiltrate arbitrary files from the server filesystem as release attachments.</p> <p>---</p> <p>## Impact</p> <p>An attacker who can supply a crafted archive to the restore-repo command can read any file accessible to the Gitea process user on the host filesystem. Sensitive targets include:</p> <p>- app.ini — containing database passwords and secret keys - SSH private keys (~/.ssh/id_rsa, /etc/ssh/ssh_host_*) - TLS certificates and private keys - Cloud provider credential files (e.g. ~/.aws/credentials) - Any other file readable by the Gitea process user</p> <p>The exfiltrated content is silently stored as a release attachment and retrievable via the Gitea API.</p> <p>---</p> <p>## Affected Code</p> <p>### modules/uri/uri.go ``` func Open(rawURL string) (io.ReadCloser, error) { u, err := url.Parse(rawURL) if err != nil {…</p> <p><strong>Affected:</strong> Go: gitea.dev</p> <p># Local File Inclusion via file:// URI in Migration Restore</p> <p>Target: go-gitea/gitea Component: services/migrations/gitea_uploader.go, modules/uri/uri.go Severity: High Affected Versions: &lt;= v1.22.x (all releases), master as of latest commit Researchers: - Isa Can — Eresus Security (https://github.com/isa0-gh) - Yigit Ibrahim — Eresus Security (https://github.com/ibrahmsql)</p> <p>---</p> <p>## Summary</p> <p>Gitea&#39;s restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open() without scheme validation. Because uri.Open() supports the file:// scheme via os.Open(), an operator-level attacker can plant a crafted release.yml to exfiltrate arbitrary files from the server filesystem as release attachments.</p> <p>---</p> <p>## Impact</p> <p>An attacker who can supply a crafted archive to the restore-repo command can read any file accessible to the Gitea process user on the host filesystem. Sensitive targets include:</p> <p>- app.ini — containing database passwords and secret keys - SSH private keys (~/.ssh/id_rsa, /etc/ssh/ssh_host_*) - TLS certificates and private keys - Cloud provider credential files (e.g. ~/.aws/credentials) - Any other file readable by the Gitea process user</p> <p>The exfiltrated content is silently stored as a release attachment and retrievable via the Gitea API.</p> <p>---</p> <p>## Affected Code</p> <p>### modules/uri/uri.go ``` func Open(rawURL string) (io.ReadCloser, error) { u, err := url.Parse(rawURL) if err != nil {…</p> https://cve.radiocsirt.org/vuln/ghsa-5ggr-2f2h-jmvm https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304