Old releases have security vulnerabilities, users need to update to the latest version

[wdqzdd]

Gitea Version

gitea/gitea:1.27.0-rootless

What happened?

The virus registers a Gitea account named gitea_exp, then creates a malicious project on the server to perform mining operations

How are you running Gitea?

No response

[wxiaoguang]

https://blog.gitea.com/release-of-1.27.1/

Security

This release addresses the following security vulnerabilities. Please upgrade as soon as possible.

    CVE-2026-59774: Unauthenticated arbitrary file read via the Org-mode #+INCLUDE directive. Fixed by [#38642](https://github.com/go-gitea/gitea/pull/38642) / [#38645](https://github.com/go-gitea/gitea/pull/38645). Thanks to [@xbow-security](https://github.com/xbow-security) and, independently, [@NightRang3r](https://github.com/NightRang3r) for reporting the issue, and to [@wxiaoguang](https://github.com/wxiaoguang) and [@TheFox0x7](https://github.com/TheFox0x7) for the patch.
    CVE-2026-60004: Remote code execution via the diffpatch API through Git hook installation. Fixed by [#38637](https://github.com/go-gitea/gitea/pull/38637) / [#38638](https://github.com/go-gitea/gitea/pull/38638). Thanks to [@NightRang3r](https://github.com/NightRang3r) for reporting the issue, and to [@wxiaoguang](https://github.com/wxiaoguang) for the patch.

So cc @bircni :

• docs: Update Changelog for release v1.27.1 #38670 (comment)

Be transparent? 2 high-level CVE fixes (score > 9, remote code execution) are not correctly listed

• docs: Update Changelog for release v1.27.1 #38670 (comment)

Blog mentioned the security fixes, but changelog/github release not didn't.

[GSimonHU]

Just updated to newest version: docker.io/gitea/gitea:1.27.1-rootless
Clean instance, brand new passwords, just the URL is the same.

Additionally set in config:
ENABLE_OPENID_SIGNIN=false
ENABLE_OPENID_SIGNUP=false
DISABLE_REGISTRATION=true
ENABLE_PASSKEY_AUTHENTICATION=false
SHOW_REGISTRATION_BUTTON=false
REQUIRE_SIGNIN_VIEW=true