gitea

2 articles · newest first

self-hosting Gitea? a stranger can read your server's secrets without logging in — patch today

A single #+INCLUDE line in a Gitea markup preview is enough for an anonymous visitor to pull your server's config file straight off disk, and from there, the path to running their own code is depressingly short.

Priya Nair · Aug 6 · 7 min

A developer's screen showing a git diff and terminal window side by side

Software

your newest Gitea contributor might already have a shell on your server

A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached.

Priya Nair · Aug 3 · 6 min