Gitea 1.25.5 Security Bulletin: Multiple CVEs (Auth/Path/Perm Bypass)

Vulnerability Overview Gitea version 1.25.5 has been released, containing multiple security fixes and stability improvements. Below are the details of the key vulnerabilities: 1. CVE-2026-25779: Prevents redirect bypasses via reverse-slash-encoded paths. 2. CVE-2026-27660: Fixes permission checks for draft releases. 3. CVE-2026-27657: Fixes the issue allowing users to change others' primary email addresses. 4. CVE-2026-26232: Fixes OAuth2 authorization code expiration and reuse handling. 5. CVE-2026-22547: Adds validation constraints to repository creation fields. 6. CVE-2026-24690: Fixes permission checks for updating or rebasing pull request branches. 7. CVE-2026-26292: Adds HTTP transport support for LFS push/sync mirror migration. 8. CVE-2026-20909: Fixes permission checks for time tracking lists. 9. CVE-2026-25782: Fixes incorrect time ID handling in time tracking. 10. CVE-2026-25718: Fixes path parsing handling. 11. CVE-2026-28705: Fixes a bug affecting release asset dumping. 12. CVE-2026-25712: Fixes visibility checks for hidden members and private organizations in the organization permissions API. 13. CVE-2026-27779: Fixes forward proto handling in public URL detection. 14. CVE-2026-26307: Adds a timeout for searches. 15. CVE-2026-26247: Fixes OAuth2 S256 handling. Impact Scope These vulnerabilities may affect all users running versions of Gitea prior to 1.25.5, particularly in scenarios involving permission management, path parsing, OAuth2 authentication, repository creation and updates, and release asset management. Remediation It is recommended that all users upgrade to Gitea version 1.25.5 to obtain the aforementioned security fixes and stability improvements. Specific steps are as follows: 1. Download pre-compiled binaries: Download the version compatible with your platform from the Gitea Download Page. 2. Install or Update: Follow the Installation Documentation to perform installation or updates. POC Code or Exploit Code No specific POC code or exploit code is provided on the page. Summary Gitea version 1.25.5 includes multiple important security fixes. It is recommended that all users upgrade as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Gitea 1.25.5 Security Bulletin: Multiple CVEs (Auth/Path/Perm Bypass)