Security week: Gitea RCE under attack, critical web flaws, and tag-name XSS

One actively exploited source-control RCE should set the order of operations this week. Behind it is an unusually dense patch queue: three unauthenticated CVSS 10.0 flaws in Adobe Campaign Classic, a default-authentication failure in Alluxio, critical SQL injection in GeoTools, and a user-assisted TeamViewer RCE. The research side is just as instructive: browsers are turning tag names into code, a forgotten video-player endpoint is still unpatched, and a paste action is enough to reach an obscure ProseMirror XSS path.

Here is the signal without the feed noise: what is being exploited, what is merely exploitable, what to patch, and what defenders and bug hunters should learn from it.

The patch queue at a glance

1. High-severity CVEs

CVE-2026-60004 — Gitea code injection/RCE — CVSS 9.8

This is the week's highest-priority item. Gitea's diffpatch endpoint can be abused to place an executable Git hook in a temporary bare clone, causing commands to run as the Gitea service account. The attacker needs ordinary repository write access—not an administrator account. On an instance that still allows open registration, a visitor can register, create a repository, and obtain that access themselves.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on 25 August with a 28 August federal remediation deadline. At least one public incident report described a miner-like payload. Upgrade every affected 1.17–1.27.0 deployment to 1.27.1 or later, disable open registration unless it is a deliberate requirement, and do not treat the upgrade as the end of the incident.

• Review repositories and temporary clone locations for unexpected executable hooks.
• Correlate diffpatch API activity with child processes launched by the Gitea user.
• If execution is suspected, isolate the host and rotate application, database, OAuth, and integration secrets reachable by the service account.

CVE-2026-76193, -76195 and -76197 — Adobe Campaign Classic — CVSS 10.0

Adobe's 25 August bulletin actually fixes three critical flaws, not two: one SSRF (CVE-2026-76193) and two OS command injections (CVE-2026-76195 and CVE-2026-76197). Adobe rates all three 10.0 and says each can lead to arbitrary code execution without authentication or user interaction.

ACC v7 7.4.4 build 9400 and earlier is affected on Windows and Linux. Upgrade on-premises and the on-premises components of hybrid deployments to build 9401, then restart nlserver so the new binaries are loaded. Adobe-hosted instances were already remediated. Adobe reported no known exploitation in the wild at publication, but a pre-authentication, zero-click path on a campaign platform is not a patch to defer.

CVE-2026-79787 — Alluxio S3 REST Proxy authentication bypass — CVSS 9.8

In Alluxio's vulnerable default configuration, the S3 REST Proxy parses the username from an AWS Signature Version 4 Authorization header without cryptographically verifying the signature. A remote attacker can therefore claim another Alluxio identity, including a service account, and inherit its ability to read, overwrite, or delete data.

The CVE record scopes affected releases through 2.9.5, while the public upstream issue says the behavior was also reproduced on a June 2026 development revision and remains open. In other words, do not infer that an arbitrary newer build is fixed. Remove the S3 proxy from public reach, restrict it to trusted clients, and—after compatibility testing—enable thealluxio.s3.rest.authentication.enabled configuration path that validates request signatures. Track the upstream issue for a confirmed fixed release before declaring remediation complete.

CVE-2026-76904 — GeoTools/PostGIS SQL injection — CVSS 9.8

The jsonArrayContains() OGC filter writes an attacker-controlled value into generated PostGIS SQL without escaping it. Exploitation is unauthenticated over the network when an exposed application uses the vulnerable GeoTools PostGIS data store, PostGIS 12 or later, and a relevant String or JSON field.

Upgrade to GeoTools 33.6, 34.5, or 35.1 for the maintained branch in use. GeoTools states that there is no complete workaround. Restricting OGC endpoints and giving the database account only the rights the application needs can reduce the blast radius, but neither substitutes for the upgrade.

CVE-2026-19042 — TeamViewer Linux client command injection — CVSS 8.8

A crafted URL sent through TeamViewer's out-of-session chat can execute commands in the context of the current Linux user after the recipient clicks it. The attacker must either be in the recipient's contact list or the recipient must have enabled messages from outsiders—a setting disabled by default. That makes it less urgent than the unauthenticated server flaws above, not harmless.

TeamViewer Full Client and Host for Linux before 15.81.5 are affected. Upgrade to 15.81.5 or later; until then, do not open links received through chat. TeamViewer said it had no indication of in-the-wild exploitation when the bulletin was published.

2. Web application security research

PortSwigger: when the tag name becomes JavaScript

Gareth Heyes's 25 August research starts with a deceptively small browser question: what characters can an HTML tag name contain? The answer opens several strange paths. Properties such as localName, part, and classList can transform a tag name into JavaScript, a URL, or fresh markup, creating unusual XSS vectors and WAF bypasses that do not resemble conventional payloads.

The defensive lesson is broader than any one vector. A blocklist that searches for familiar tags or event-handler shapes is trying to outguess a browser parser that is deliberately permissive. Use context-aware output encoding, a maintained parser-backed sanitizer, and a restrictive Content Security Policy. Treat WAF detection as a useful layer, not the control that makes untrusted HTML safe.

Kaltura mwEmbed: unpatched file read and RCE

CERT/CC disclosed two unauthenticated flaws in Kaltura's older mwEmbed/html5lib player on 25 August. CVE-2026-19913 lets a user-controlled ServiceUrl point at a local file; unsafe deserialization and error handling can reflect that file back to the requester. CVE-2026-19912 adds an unsanitized cache-path value. With the default file cache, an attacker can steer serialized content into a web-accessible location and reach code execution as the web-server user.

There was no vendor patch or statement when CERT/CC published. Restrict or disable external access to mwEmbedLoader.php, strictly allowlist legitimate ServiceUrl origins and schemes, and search for the endpoint in old player bundles and CDN-backed integrations—not only in applications that still advertise Kaltura by name.

ProseMirror: paste-based XSS in prosemirror-view

Versions of prosemirror-view before 1.42.3 contain a high-severity XSS path triggered when a user pastes attacker-crafted HTML into an editor. The maintainer described the trick as clever and obscure and reported no known exploitation, but there is no workaround in the advisory. Upgrade to 1.42.3 or later and remember that clipboard HTML crosses a trust boundary just like network input.

3. Bug bounty highlights

TranslatePress: a translated reset email becomes an admin takeover

Yuto Hyakumoto (momopon1415) earned $975 through Wordfence for CVE-2026-19632, affecting a plugin with more than 400,000 active installations. Under the vulnerable multilingual configuration, TranslatePress stored an administrator's password-reset email—including its one-time URL—in translation data that a public AJAX action could return. The result was unauthenticated administrator account takeover.

Versions through 3.3.1 are affected; upgrade to 3.3.2 or later. The useful hunting lesson is compositional: an email-translation feature and a public lookup endpoint may each appear reasonable in isolation, while the data flow between them leaks a credential. Two-factor authentication or passkeys add a valuable second barrier for administrator accounts.

Elementor Pro: the value of hunting chains, not isolated primitives

CVE-2026-32475 is an unauthenticated arbitrary-file-upload chain that can become RCE on sites using a vulnerable Elementor Pro Forms configuration. Patchstack credits Tin Pham (TF1T) with the original report. Austin Ginder later found the same issue independently through AI-directed chain hunting and disclosed that Wordfence paid $15,600 for his duplicate report—the largest publicly disclosed single-finding Wordfence payout he could identify.

Elementor Pro through 4.2.1 is affected; update to 4.2.2 or later. For researchers, the durable lesson is to keep following state: a file-handling primitive that looks constrained can become critical when another component reveals the path or treats the result as executable. AI helped explore the chain, but a human still framed the hypothesis, validated the behavior, and submitted evidence.

MetForm: a dropdown is not a security boundary

CVE-2026-18100 let a Contributor-level user store script-capable input in MetForm's mf_form_id Elementor widget setting. The editor presented a dropdown, but the server did not enforce the assumed numeric type before the value reached a render path capable of executing it. MetForm 4.1.9 fixed the stored XSS by rejecting untrusted non-numeric values and removing the dangerous transformation.

That pattern is worth adding to every page-builder review: mutate IDs, enum values, and widget state outside the UI. Client-side controls describe the happy path; only server-side validation establishes a boundary.

What defenders should do today

• Inventory from the edge inward. Find internet-reachable Gitea, Adobe Campaign, GeoServer/GeoTools, Alluxio proxy, Kaltura, and WordPress instances before relying on an internal software inventory.
• Patch Gitea and hunt the pre-patch window. A KEV entry is evidence of exploitation, not merely a higher score in a spreadsheet.
• Contain what cannot yet be patched. Put Alluxio and Kaltura endpoints behind explicit network and application allowlists while tracking vendor remediation.
• Update transitive web dependencies. Search lockfiles for prosemirror-view, and verify the deployed bundle—not only the manifest.
• Test the seams. Authentication headers, cache paths, widget state, clipboard HTML, and parser transformations are where this week's most useful bugs lived.

Sources

• Gitea — GHSA-rcr6-4jqh-j84m and the CISA KEV catalog, plus public incident reporting.
• Adobe — Campaign Classic bulletin APSB26-134.
• Alluxio — CVE-2026-79787 record and upstream issue #18755.
• GeoTools — GHSA-mqjf-5f49-2fjh.
• TeamViewer — security bulletin TV-2026-1009.
• PortSwigger Research — What's in a tag name? JavaScript, apparently.
• CERT/CC — VU#308749: Kaltura file read and RCE.
• ProseMirror — paste-handling XSS advisory.
• Wordfence — TranslatePress account-takeover analysis.
• Patchstack — Elementor Pro technical analysis; Austin Ginder — AI-directed duplicate discovery write-up.
• CryptoCat — MetForm CVE-2026-18100 analysis.