From c525300036b4c263d40652eaeeda0a1e97b3812e Mon Sep 17 00:00:00 2001 From: Erki Aas Date: Tue, 15 Sep 2026 22:04:34 +0300 Subject: [PATCH] gitea v1.27.3 Fixes CVE-2026-59774, an unauthenticated arbitrary file read in the Org-mode renderer (POST /{owner}/{repo}/markup, #+INCLUDE directive) affecting 1.22.1-1.27.0. It was used against this instance on 2026-09-10 to read app.ini, steal INTERNAL_TOKEN and plant an uploadpack packObjectsHook that ran a Monero miner on every clone. The 1.25 branch never received the fix, so this skips 1.26. Env-var config still works: the rootless image's environment-to-ini is now a shim for `gitea config edit-ini --in-place --apply-env`. Co-Authored-By: Claude Opus 5 (1M context) --- gitea/application.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitea/application.yaml b/gitea/application.yaml index 0ba752d..bec2cd1 100644 --- a/gitea/application.yaml +++ b/gitea/application.yaml @@ -120,7 +120,7 @@ spec: containers: - name: gitea # https://github.com/go-gitea/gitea/releases - image: docker.gitea.com/gitea:1.25.3-rootless + image: docker.gitea.com/gitea:1.27.3-rootless imagePullPolicy: IfNotPresent securityContext: readOnlyRootFilesystem: true