https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:23:11 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-58420 <p>Local File Inclusion via file:// URI in Migration Restore</p> <p>Local File Inclusion via file:// URI in Migration Restore</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-58420 https://vulnerability.circl.lu/vuln/ghsa-5ggr-2f2h-jmvm <p><strong>Affected:</strong> Go: gitea.dev</p> <p># Local File Inclusion via file:// URI in Migration Restore</p> <p>Target: go-gitea/gitea Component: services/migrations/gitea_uploader.go, modules/uri/uri.go Severity: High Affected Versions: &lt;= v1.22.x (all releases), master as of latest commit Researchers: - Isa Can — Eresus Security (https://github.com/isa0-gh) - Yigit Ibrahim — Eresus Security (https://github.com/ibrahmsql)</p> <p>---</p> <p>## Summary</p> <p>Gitea&#39;s restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open() without scheme validation. Because uri.Open() supports the file:// scheme via os.Open(), an operator-level attacker can plant a crafted release.yml to exfiltrate arbitrary files from the server filesystem as release attachments.</p> <p>---</p> <p>## Impact</p> <p>An attacker who can supply a crafted archive to the restore-repo command can read any file accessible to the Gitea process user on the host filesystem. Sensitive targets include:</p> <p>- app.ini — containing database passwords and secret keys - SSH private keys (~/.ssh/id_rsa, /etc/ssh/ssh_host_*) - TLS certificates and private keys - Cloud provider credential files (e.g. ~/.aws/credentials) - Any other file readable by the Gitea process user</p> <p>The exfiltrated content is silently stored as a release attachment and retrievable via the Gitea API.</p> <p>---</p> <p>## Affected Code</p> <p>### modules/uri/uri.go ``` func Open(rawURL string) (io.ReadCloser, error) { u, err := url.Parse(rawURL) if err != nil {…</p> <p><strong>Affected:</strong> Go: gitea.dev</p> <p># Local File Inclusion via file:// URI in Migration Restore</p> <p>Target: go-gitea/gitea Component: services/migrations/gitea_uploader.go, modules/uri/uri.go Severity: High Affected Versions: &lt;= v1.22.x (all releases), master as of latest commit Researchers: - Isa Can — Eresus Security (https://github.com/isa0-gh) - Yigit Ibrahim — Eresus Security (https://github.com/ibrahmsql)</p> <p>---</p> <p>## Summary</p> <p>Gitea&#39;s restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open() without scheme validation. Because uri.Open() supports the file:// scheme via os.Open(), an operator-level attacker can plant a crafted release.yml to exfiltrate arbitrary files from the server filesystem as release attachments.</p> <p>---</p> <p>## Impact</p> <p>An attacker who can supply a crafted archive to the restore-repo command can read any file accessible to the Gitea process user on the host filesystem. Sensitive targets include:</p> <p>- app.ini — containing database passwords and secret keys - SSH private keys (~/.ssh/id_rsa, /etc/ssh/ssh_host_*) - TLS certificates and private keys - Cloud provider credential files (e.g. ~/.aws/credentials) - Any other file readable by the Gitea process user</p> <p>The exfiltrated content is silently stored as a release attachment and retrievable via the Gitea API.</p> <p>---</p> <p>## Affected Code</p> <p>### modules/uri/uri.go ``` func Open(rawURL string) (io.ReadCloser, error) { u, err := url.Parse(rawURL) if err != nil {…</p> https://vulnerability.circl.lu/vuln/ghsa-5ggr-2f2h-jmvm