CVE-2022-27313

Vulnerability

An arbitrary file deletion vulnerability exists in Gitea version 1.16.3 [1]. The issue allows an attacker to delete the configuration file (app.ini), causing the instance to become inoperable. The exact code path is not publicly detailed, but the vulnerability is present in the default configuration and does not require any special settings.

Exploitation

An attacker with authenticated access (likely user-level privileges) can exploit the vulnerability to delete the configuration file. The specific steps are not disclosed, but the attack is feasible without administrative rights.

Impact

Successful exploitation leads to the deletion of the Gitea configuration file, resulting in a denial of service (DoS) as the instance fails to start or operate correctly. No data corruption or remote code execution is associated with this CVE.

Mitigation

The vulnerability is fixed in Gitea version 1.16.4, released on March 14, 2022 [2][3]. Users should upgrade to this version or later. No workaround is available for earlier versions.