GHSA-hf6f-jq25-8gq9
Gitea Remote Code Execution (RCE)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | code.gitea.io/gitea | < 1.5.2 | 1.5.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.
References
External links from the advisory. They lead to third-party sites.