exdb 52087 status request #14312

New Issue

GiteaMirror · 2025-11-02T11:09:33-06:00

GiteaMirror commented

2025-11-02 11:09:33 -06:00

Originally created by @z00z00z00 on GitHub (Mar 27, 2025).

Description

Hello Gitea team,

Mikail KOCADAĞ disclosed [1] a vulnerability that might affect Gitea.

He mentioned version 1.24.0 as the affected one - but this version doesn't seem to be available to download (beta version ?). There is no information if he disclosed to you the issue before publishing it through Exploit DB.

Did they disclose this issue to you ?

If so, do you have any status on this ?

Thanks in advance :)
Best

[1] https://www.exploit-db.com/exploits/52087

Gitea Version

1.24.0

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

N/A

Database

None

Originally created by @z00z00z00 on GitHub (Mar 27, 2025). ### Description Hello Gitea team, Mikail KOCADAĞ disclosed [1] a vulnerability that might affect Gitea. He mentioned version 1.24.0 as the affected one - but this version doesn't seem to be available to download (beta version ?). There is no information if he disclosed to you the issue before publishing it through Exploit DB. Did they disclose this issue to you ? If so, do you have any status on this ? Thanks in advance :) Best [1] https://www.exploit-db.com/exploits/52087 ### Gitea Version 1.24.0 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? N/A ### Database None

GiteaMirror added the issue/not-a-bug label 2025-11-02 11:09:33 -06:00

GiteaMirror closed this issue

2025-11-02 11:09:33 -06:00

GiteaMirror commented

2025-11-02 11:09:34 -06:00

@techknowlogick commented on GitHub (Mar 27, 2025):

Several HTML tags are allowed in that field, but are run through a sanitizer first. You'll see that the JS isn't presented to the end user, nor is it executed.
Further more, I have not received any reports from this individual where we could've explained this to them.

TLDR: No XSS is happening, and there is no exploit.

@techknowlogick commented on GitHub (Mar 27, 2025): Several HTML tags are allowed in that field, but are run through a sanitizer first. You'll see that the JS isn't presented to the end user, nor is it executed. Further more, I have not received any reports from this individual where we could've explained this to them. TLDR: No XSS is happening, and there is no exploit.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14312