https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:14:53 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-10703 bdu:2026-10703 https://cve.radiocsirt.org/vuln/bdu:2026-10703 https://cve.radiocsirt.org/vuln/bit-gitea-2026-60004 <p><strong>Affected:</strong> Bitnami: gitea</p> <p>Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.</p> <p><strong>Affected:</strong> Bitnami: gitea</p> <p>Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.</p> https://cve.radiocsirt.org/vuln/bit-gitea-2026-60004 https://cve.radiocsirt.org/vuln/euvd-2026-365281 EUVD-2026-365281 https://cve.radiocsirt.org/vuln/euvd-2026-365281 https://cve.radiocsirt.org/vuln/fkie_cve-2026-60004 <p>Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.</p> <p>Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-60004 https://cve.radiocsirt.org/vuln/ghsa-rcr6-4jqh-j84m <p><strong>Affected:</strong> Go: gitea.dev</p> <p>### Summary</p> <p>Gitea&#39;s `diffpatch` endpoint can be abused to install and execute a Git hook from repository-controlled content.</p> <p>An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.</p> <p>### Details</p> <p>`services/repository/files/patch.go` applies attacker-controlled patches in a shared bare temporary clone:</p> <p>```go cmdApply := gitcmd.NewCommand(&#34;apply&#34;, &#34;--index&#34;, &#34;--recount&#34;, &#34;--cached&#34;, &#34;--binary&#34;) if git.DefaultFeatures().CheckVersionAtLeast(&#34;2.32&#34;) { cmdApply.AddArguments(&#34;-3&#34;) } ````</p> <p>Submitting the same patch twice creates an add/add collision. Git&#39;s three-way fallback checks the indexed path out even though the operation is performed with `--cached`.</p> <p>In a bare clone, the repository root is `$GIT_DIR`. As a result, an executable entry named:</p> <p>```text hooks/post-index-change ```</p> <p>becomes a live Git hook.</p> <p>Git invokes the hook while writing the index, allowing repository-controlled content to execute arbitrary commands as the Gitea service account.</p> <p>The hook&#39;s return value is not propagated to the `diffpatch` response.</p> <p>The attached PoC stores command output in Git objects and creates a branch containing the result, so no outbound connection is required. The result is fetched through authenticated smart HTTP.</p> <p>### PoC</p> <p>The supplied `gitea_diffpatch_rce_poc.py` uses an…</p> <p><strong>Affected:</strong> Go: gitea.dev</p> <p>### Summary</p> <p>Gitea&#39;s `diffpatch` endpoint can be abused to install and execute a Git hook from repository-controlled content.</p> <p>An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.</p> <p>### Details</p> <p>`services/repository/files/patch.go` applies attacker-controlled patches in a shared bare temporary clone:</p> <p>```go cmdApply := gitcmd.NewCommand(&#34;apply&#34;, &#34;--index&#34;, &#34;--recount&#34;, &#34;--cached&#34;, &#34;--binary&#34;) if git.DefaultFeatures().CheckVersionAtLeast(&#34;2.32&#34;) { cmdApply.AddArguments(&#34;-3&#34;) } ````</p> <p>Submitting the same patch twice creates an add/add collision. Git&#39;s three-way fallback checks the indexed path out even though the operation is performed with `--cached`.</p> <p>In a bare clone, the repository root is `$GIT_DIR`. As a result, an executable entry named:</p> <p>```text hooks/post-index-change ```</p> <p>becomes a live Git hook.</p> <p>Git invokes the hook while writing the index, allowing repository-controlled content to execute arbitrary commands as the Gitea service account.</p> <p>The hook&#39;s return value is not propagated to the `diffpatch` response.</p> <p>The attached PoC stores command output in Git objects and creates a branch containing the result, so no outbound connection is required. The result is fetched through authenticated smart HTTP.</p> <p>### PoC</p> <p>The supplied `gitea_diffpatch_rce_poc.py` uses an…</p> https://cve.radiocsirt.org/vuln/ghsa-rcr6-4jqh-j84m https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2557 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Gitea ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Gitea ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2557