M2Hcz

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.26.3 **Description** Git LFS (Large File Storage) object reuse allows users with repository access to authorize private source objects even if they lack Code-unit access. **Recommendations** Update Gitea to version 1.26.3 or later.

**Name of the Vulnerable Software and Affected Versions** File Browser (affected versions not specified) **Description** File Browser fails to properly validate symbolic links, allowing scoped users or unauthenticated public-share recipients to access files outside their intended directory boundaries. While the software prevents lexical `../` traversal, it does not stop handlers from following symlinks that point to locations outside the user's scope. This occurs in two ways: when a symlink is the final path component, or when a file is accessed through a symlinked ancestor directory. This issue affects reading, writing (including TUS resumable uploads), share creation, and public-share serving. An attacker can use these flaws to read out-of-scope file contents, overwrite files, or create public shares for restricted data. Technical details include vulnerabilities in the following endpoints and functions: - API Endpoints: `GET /api/raw/{path}`, `GET /api/resources/{path}`, `POST /api/resources/{path}`, `POST /api/tus/{path}`, `PATCH /api/tus/{path}`, `POST /api/share/{path}`, and `GET /api/public/dl/{hash}`. - Vulnerable Parameters: `path` and `override`. - Vulnerable Functions: `stat()`, `readListing()`, `getFiles()`, `writeFile()`, `tusPostHandler()`, and `tusPatchHandler()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.