CVE Vulnerability Catalog

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped.

Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host namespace settings, expanded capabilities, and security profile overrides can remain effective despite Privileged being forced false.

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event.

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.

Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn verification before completing sign-in and linking an OpenID identifier. When OpenID sign-in is enabled, an attacker who knows the victim's password can obtain a session and link an attacker-controlled identifier. The attacker can then sign in through that identifier without the victim's password or second factor, and a password change does not remove the link.

In Gitea, the pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval.

In Gitea, first-time fork contributor approval is enforced by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval.

Vulnerability in util-linux versions 2.17 through 2.41.6, 2.42 through 2.42.3, and 2.42.4 when the legacy mount(2) path is used without /proc. Restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab user or users entry can use renameat2(RENAME_EXCHANGE) to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over /etc/sudoers.d, thereby gaining root privileges.

Vulnerability in util-linux versions 2.39 through 2.41.4 and 2.42 through 2.42.1. The SUID mount utility's hook_owner.c post-mount hook performs path-based chmod() and lchown() operations on a previously validated mount target. A local low-privileged user authorized by an /etc/fstab entry with user or users and an X-mount.mode, X-mount.owner, or X-mount.group option can use renameat2(RENAME_EXCHANGE) to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges.

Vulnerability in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to restart or potential code execution.

Vulnerability in @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.

Turnpress through 0.4.2 contains an OS command injection vulnerability. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, allowing shell metacharacters in the --docx path to execute commands with the victim's privileges.

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec().

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer(). Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability. Attackers can supply crafted archive file names to compress_file, injecting $() substitutions or unquoted shell metacharacters into shelljs exec() calls.

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability. Low-privileged users can make the SYSTEM updater service install attacker-supplied archives into arbitrary directories, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095. Remote attackers can redirect the SYSTEM updater by invoking the UpdateConfigReferent method and pointing it to a malicious reference server.

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API. Authenticated users can share other users' documents by supplying arbitrary node UUIDs, then read, modify, or delete victims' documents and revoke existing shares.