Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-104266. PoCs published by Kacper Szurek.
AI-analyzed exploit summary This exploit leverages a race condition and JWT token manipulation in Gitea 1.4.0 to achieve unauthenticated remote code execution. It abuses LFS (Large File Storage) endpoints to overwrite session files and escalate privileges to admin, then executes arbitrary commands via Git hooks.
Description
Gitea 1.4.0 - Remote Code Execution
Exploits (1)
This exploit leverages a race condition and JWT token manipulation in Gitea 1.4.0 to achieve unauthenticated remote code execution. It abuses LFS (Large File Storage) endpoints to overwrite session files and escalate privileges to admin, then executes arbitrary commands via Git hooks.