Ibrahmsql

**Name of the Vulnerable Software and Affected Versions** Gitea versions 1.22.x and earlier **Description** A Local File Inclusion issue exists in the restore-repo command when processing release.yml files from user-supplied archives. The `DownloadURL` field in release attachments is passed to the `uri.Open()` function without scheme validation. Since `uri.Open()` supports the `file://` scheme via `os.Open()`, an attacker with operator-level access can use a crafted release.yml to exfiltrate arbitrary files accessible to the Gitea process user from the server filesystem. These files are then stored as release attachments and can be retrieved via the Gitea API. The issue is rooted in the `uri.Open()` function within `modules/uri/uri.go` and its invocation in `services/migrations/gitea uploader.go`. **Recommendations** Update Gitea to a version later than 1.22.x. In `services/migrations/gitea uploader.go`, validate that the `DownloadURL` scheme is restricted to http or https before calling `uri.Open()`. As a temporary workaround, restrict the execution of the restore-repo command to fully trusted operators and manually audit archive contents before restoration.

**Name of the Vulnerable Software and Affected Versions** ZAI Shell versions prior to 9.0.3 **Description** ZAI Shell, an autonomous SysOps agent, has an issue in its P2P terminal sharing feature (share start). Before version 9.0.3, this feature opens a TCP socket on port 5757 without authentication. A remote attacker connecting to this port can send arbitrary system commands. If the host user approves these commands without review, they execute with the user's privileges, bypassing Sentinel safety checks. The vulnerable component is the P2P terminal sharing feature, specifically the 'share start' functionality. The affected API endpoint is a TCP socket on port `5757`. The vulnerable parameter is the system command sent through the socket. **Recommendations** Update to version 9.0.3 or later.