Vulnerability GO-2026-6433
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
September 10, 2026 at 02:48 PM UTC
Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev
v1.17.0 - v1.28.0-dev
v1.17.0 - v1.28.0-dev
Summary
Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev
Details
Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6343
v0.9.99 - v1.25.4 GO-2026-6343
Unknown
1 month ago
Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6344
v0.9.99 - v1.25.4 GO-2026-6344
Unknown
1 month ago
Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6345
v0.9.99 - v1.25.4 GO-2026-6345
Unknown
1 month ago
Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea
v0.9.99 - v1.26.0-rc0 GO-2026-6346
v0.9.99 - v1.26.0-rc0 GO-2026-6346
Unknown
1 month ago
Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6347
v0.9.99 - v1.25.4 GO-2026-6347
Impacted packages
Timeline
Published
1 month ago
September 10, 2026 at 02:48 PM UTC
Fixed (v1.27.1)
3 months ago
July 27, 2026 at 06:43 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:25 PM UTC