Multiple Critical Vulnerability Disclosures Across Gogs, Jinjava, and Kubernetes Local Path Provisioner

Several high-severity vulnerability disclosures were published across widely used developer and infrastructure components, with impacts ranging from remote code execution (RCE) to account takeover and arbitrary host file writes. In Gogs (self-hosted Git service), three CVEs were reported: CVE-2025-64111 (CVSS 9.3) enables RCE by bypassing checks in UpdateRepoFile to modify .git/config via the API (described as an insufficient fix for an earlier issue); CVE-2025-64175 (CVSS 7.7) allows a cross-account 2FA recovery-code bypass in versions 0.13.3 and earlier if an attacker already has a victim’s username/password; and CVE-2026-24135 (CVSS 7.2) is a wiki rename path traversal that can delete arbitrary files by manipulating old_title. Separately, Jinjava (HubSpot CMS template engine) disclosed CVE-2026-25526 (CVSS 9.8), a sandbox escape chain that permits arbitrary Java code execution by abusing ForTag iteration behavior (Bean ELResolver restriction bypass) and ObjectMapper-based JSON deserialization to instantiate disallowed classes.

A critical Kubernetes storage issue was also disclosed in Kubernetes Local Path Provisioner: CVE-2025-62878 (CVSS 10.0) allows directory traversal via the parameters.pathPattern setting, enabling a user who can create storage resources to provision volumes in arbitrary host locations (e.g., /etc) and potentially overwrite sensitive files on cluster nodes. In parallel to these product flaws, separate research reported widespread exposure of Git metadata on the public internet—approximately 4.96 million IPs with accessible .git directories and 250,000+ exposing .git/config files that may contain deployment credentials—highlighting a common, high-impact misconfiguration pattern that can enable source code reconstruction and secret theft. Active exploitation activity was reported for Ivanti Endpoint Manager Mobile (EPMM) involving CVE-2026-1281 and CVE-2026-1340, where attackers were observed dropping /mifs/403.jsp and using a Base64-delivered Java class loader designed for delayed, in-memory activation rather than immediate interactive webshell use.