forked from k-space/kube
Erki AasandClaude Opus 5
c525300036
Fixes CVE-2026-59774, an unauthenticated arbitrary file read in the
Org-mode renderer (POST /{owner}/{repo}/markup, #+INCLUDE directive)
affecting 1.22.1-1.27.0. It was used against this instance on 2026-09-10
to read app.ini, steal INTERNAL_TOKEN and plant an uploadpack
packObjectsHook that ran a Monero miner on every clone. The 1.25 branch
never received the fix, so this skips 1.26.
Env-var config still works: the rootless image's environment-to-ini is
now a shim for `gitea config edit-ini --in-place --apply-env`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Gitea
This application is managed by ArgoCD
Should ArgoCD be down manifests here can be applied with:
kustomize build . | kubectl apply -f -
Gitea DOES NOT go through Traefik. It has its own IP because ssh :22 would conflict with kube worker ssh. On its own IP, at the moment it doesn't flirt with Traefik — also has its own certificate.