optimism

Remote code execution is hard but fortunately most Gitea instances aren't exposed to the open internet

tomlaies

 ) disclosure for a 9.8 score vulnerability that allows remote code execution.

The exploit is published in the disclosure itself: 

Many Gitea instances that didn't update after July 27, are currently under attack by an automated campaign that tries to perform privilege escalation and compromise the host.

  have registration enabled to be vulnerable, since the attacker needs an account.

Please, if you run a Gitea instance with registrations enabled, check that your version is updated and your host uncompromised.

security

Gitea team  fucked up ( *in my opinion* ) disclosure for a 9.8 score vulnerability that allows remote code execution.

The exploit is published in the disclosure itself: [GHSA-rcr6-4jqh-j84m](https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m)

Many Gitea instances that didn't update after July 27, are currently under attack by an automated campaign that tries to perform privilege escalation and compromise the host.

The Gitea instance **must**  have registration enabled to be vulnerable, since the attacker needs an account.

Please, if you run a Gitea instance with registrations enabled, check that your version is updated and your host uncompromised.