Created attachment 273344 [details] patch to update www/gitea port to 1.27.1 1.27.1 fixes these issues: CVE-2026-59774: Unauthenticated arbitrary file read via the Org-mode #+INCLUDE directive. Fixed by #38642 / #38645. Thanks to @xbow-security and, independently, @NightRang3r for reporting the issue, and to @wxiaoguang and @TheFox0x7 for the patch. CVE-2026-60004: Remote code execution via the diffpatch API through Git hook installation. Fixed by #38637 / #38638. Thanks to @NightRang3r for reporting the issue, and to @wxiaoguang for the patch. in addition to the issues fixed in 1.27.0, see https://blog.gitea.com/release-of-1.27.0/ builds fine on 14.4, 15.0 and 15.1 (all amd64) here.
Any update on this? The last version in ports is v1.26.4, which is severly vulnerable. v1.27.0 has address 45 CVEs and v1.27.1 another 2: https://blog.gitea.com/release-of-1.27.0/ https://blog.gitea.com/release-of-1.27.1/ I've also used the same patch and it builds and runs fine for me.
(In reply to Mamadou Babaei from comment #1) https://github.com/go-gitea/gitea/releases/tag/v1.27.2 new version, with another portion of bug fixes. Have modified my build tree, it works without issues also ( tested with go 1.26.6 ).
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=c81002f9d9b6dba0aaef25ebf36a8d1b801252df commit c81002f9d9b6dba0aaef25ebf36a8d1b801252df Author: Jochen Neumeister <joneum@FreeBSD.org> AuthorDate: 2026-08-16 18:30:26 +0000 Commit: Jochen Neumeister <joneum@FreeBSD.org> CommitDate: 2026-08-16 18:31:22 +0000 www/gitea: Update to 1.27.2 Changelog: https://blog.gitea.com/release-of-1.27.0/ https://blog.gitea.com/release-of-1.27.1/ https://github.com/go-gitea/gitea/releases/tag/v1.27.2 Security: 2f3568eb-999e-11f1-a655-3497f65b111b Security: f4af92f7-95ae-11f1-a6f7-b42e991fc52e PR: 297194 Reported by: FiLiS Approved by: maintainer timeout (ports@foss-daily.org) Sponsored by: Netzkommune GmbH www/gitea/Makefile | 3 +-- www/gitea/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-)
A commit in branch 2026Q3 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=ddef84a05ac70ffe5bd15b756fc5ba30091bb7af commit ddef84a05ac70ffe5bd15b756fc5ba30091bb7af Author: Jochen Neumeister <joneum@FreeBSD.org> AuthorDate: 2026-08-16 18:30:26 +0000 Commit: Jochen Neumeister <joneum@FreeBSD.org> CommitDate: 2026-08-16 18:36:19 +0000 www/gitea: Update to 1.27.2 Changelog: https://blog.gitea.com/release-of-1.27.0/ https://blog.gitea.com/release-of-1.27.1/ https://github.com/go-gitea/gitea/releases/tag/v1.27.2 Security: 2f3568eb-999e-11f1-a655-3497f65b111b Security: f4af92f7-95ae-11f1-a6f7-b42e991fc52e PR: 297194 Reported by: FiLiS Approved by: maintainer timeout (ports@foss-daily.org) Sponsored by: Netzkommune GmbH (cherry picked from commit c81002f9d9b6dba0aaef25ebf36a8d1b801252df) www/gitea/Makefile | 3 +-- www/gitea/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-)