Software
self-hosting Gitea? a stranger can read your server's secrets without logging in — patch today
A single #+INCLUDE line in a Gitea markup preview is enough for an anonymous visitor to pull your server's config file straight off disk, and from there, the path to running their own code is depressingly short.
Priya Nair · 2h ago · 7 min