https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:05:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333338 EUVD-2026-333338 https://cve.radiocsirt.org/vuln/euvd-2026-333338 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58426 <p>Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write</p> <p>Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58426 https://cve.radiocsirt.org/vuln/ghsa-hg5r-vq93-9fv6 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary</p> <p>Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact into a URL that reads artifacts from another task context, or writes attacker-controlled data into another task&#39;s artifact upload staging context, including in a private repository.</p> <p>This is one vulnerability with two exploit paths:</p> <p>- `DownloadArtifact`: cross-task/cross-repository artifact read, giving `C:H`. - `UploadArtifact`: cross-task artifact staging write and metadata mutation, giving `I:H`.</p> <p>### Details</p> <p>The root cause is that the V4 artifact signed URL signature is built from raw concatenated fields without delimiters or length-prefixing:</p> <p>```go func (r *artifactV4Routes) buildSignature(endpoint, expires, artifactName string, taskID, artifactID int64) []byte { mac := hmac.New(sha256.New, setting.GetGeneralTokenSigningSecret()) mac.Write([]byte(endpoint)) mac.Write([]byte(expires)) mac.Write([]byte(artifactName)) _, _ = fmt.Fprint(mac, taskID) _, _ = fmt.Fprint(mac, artifactID) return mac.Sum(nil) } ```</p> <p>Affected code: `routers/api/actions/artifactsv4.go:164-171`.</p> <p>Because `artifactName`, `taskID`, and `artifactID` are concatenated without boundaries, two different URL tuples can produce the same HMAC input. For e…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary</p> <p>Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact into a URL that reads artifacts from another task context, or writes attacker-controlled data into another task&#39;s artifact upload staging context, including in a private repository.</p> <p>This is one vulnerability with two exploit paths:</p> <p>- `DownloadArtifact`: cross-task/cross-repository artifact read, giving `C:H`. - `UploadArtifact`: cross-task artifact staging write and metadata mutation, giving `I:H`.</p> <p>### Details</p> <p>The root cause is that the V4 artifact signed URL signature is built from raw concatenated fields without delimiters or length-prefixing:</p> <p>```go func (r *artifactV4Routes) buildSignature(endpoint, expires, artifactName string, taskID, artifactID int64) []byte { mac := hmac.New(sha256.New, setting.GetGeneralTokenSigningSecret()) mac.Write([]byte(endpoint)) mac.Write([]byte(expires)) mac.Write([]byte(artifactName)) _, _ = fmt.Fprint(mac, taskID) _, _ = fmt.Fprint(mac, artifactID) return mac.Sum(nil) } ```</p> <p>Affected code: `routers/api/actions/artifactsv4.go:164-171`.</p> <p>Because `artifactName`, `taskID`, and `artifactID` are concatenated without boundaries, two different URL tuples can produce the same HMAC input. For e…</p> https://cve.radiocsirt.org/vuln/ghsa-hg5r-vq93-9fv6 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149