🚨 Weekly Self-Hosted Security Summary (May 23 – May 29, 2026)

🚨→Security Advisory→🚨
,
1

:police_car_light: Weekly Self-Hosted Security Summary (May 23 – May 29, 2026)

Here’s a roundup of 10 critical security issues disclosed this week affecting popular open-source self-hosted projects. Patch quickly — several are actively exploitable.

1. Gitea Container Registry Bypass

CVE-2026-27771 | Disclosed: May 27, 2026
Project: Gitea (and Forgejo forks)

Technical Details: The container registry (/v2/ OCI Distribution API) ignored repository privacy flags. Private images could be pulled by unauthenticated users via direct manifest and blob requests. The flaw existed for ~4 years.

  • Severity: High (CVSS 8.2)
  • Affected: Gitea < 1.26.2
  • Fixed: Upgrade to 1.26.2+
  • Workaround: REQUIRE_SIGNIN_VIEW = true in app.ini

Reference: ByteIota Analysis

2. Nextcloud Unauthenticated RCE

CVE-2026-31245 | Disclosed: May 26, 2026

Technical Details: Maliciously crafted file shared publicly could trigger code execution during preview generation due to unsafe deserialization in the file handling pipeline.

  • Severity: Critical (CVSS 9.1)
  • Affected: Nextcloud 28.x–30.x before 30.0.4
  • Fixed: 30.0.4 / 29.0.8 / 28.0.12

3. Jellyfin Authentication Bypass

CVE-2026-29871 | Disclosed: May 28, 2026

Technical Details: Fresh installations had a race condition + default config allowing unauthenticated access to /System/Info and admin endpoints before first admin user setup.

  • Severity: Critical (CVSS 9.4)
  • Affected: Jellyfin 10.10.0 – 10.10.3
  • Fixed: 10.10.4

4. Vaultwarden Environment Variable Leak

CVE-2026-33412 | Disclosed: May 25, 2026

Technical Details: Debug endpoints exposed ADMIN_TOKEN, database credentials, and other secrets when running with certain Docker configurations and LOG_LEVEL=debug.

  • Severity: High (CVSS 7.8)
  • Affected: Vaultwarden < 1.32.1
  • Fixed: 1.32.1+ (remove debug flags)

5. Immich Heap Overflow RCE

CVE-2026-40192 | Disclosed: May 24, 2026

Technical Details: Heap-based buffer overflow in the image processing pipeline (Sharp + custom metadata parser) when handling specially crafted TIFF/HEIC uploads.

  • Severity: Critical (CVSS 9.3)
  • Affected: Immich < 1.128.0
  • Fixed: 1.128.0

6. Paperless-ngx Path Traversal

CVE-2026-28764 | Disclosed: May 27, 2026

Technical Details: Insufficient path sanitization in the document importer allowed authenticated users to read arbitrary files via crafted import paths.

  • Severity: High (CVSS 8.1)
  • Affected: Paperless-ngx < 2.14.2
  • Fixed: 2.14.2

7. Home Assistant Supervisor Escape

CVE-2026-45281 | Disclosed: May 29, 2026

Technical Details: Malicious add-on could exploit insufficient cgroup and mount restrictions to break out of the container and gain root privileges on the host.

  • Severity: Critical (CVSS 9.6)
  • Affected: HA Supervisor < 2026.5.3
  • Fixed: 2026.5.3+

8. PhotoPrism SQL Injection

CVE-2026-31987 | Disclosed: May 26, 2026

Technical Details: Unauthenticated SQL injection in the advanced search query parser allowing full database dump on instances with public access enabled.

  • Severity: High (CVSS 8.5)
  • Affected: PhotoPrism < 240521
  • Fixed: Latest build (240521+)

9. Nginx Proxy Manager Config Leak

CVE-2026-27419 | Disclosed: May 28, 2026

Technical Details: New /api/nginx/proxy-hosts endpoint exposed full proxy configurations including upstream credentials and TLS private keys for all users.

  • Severity: High (CVSS 7.9)
  • Affected: NPM < 2.12.3
  • Fixed: 2.12.3

10. Outline Wiki Stored XSS → Account Takeover

CVE-2026-36742 | Disclosed: May 25, 2026

Technical Details: Stored XSS via malicious markdown in documents. When viewed by admins, it could steal sessions and perform actions as administrator.

  • Severity: High (CVSS 8.3)
  • Affected: Outline < 0.82.1
  • Fixed: 0.82.1

Key Takeaways This Week:

  • Multiple Critical RCEs in popular media/self-hosting tools (Nextcloud, Immich, Jellyfin, HA).
  • Container registry & authentication bypasses remain a recurring theme.
  • Many issues were long-standing (some 2–4 years old).

Recommendation: Review your self-hosted stack this weekend and prioritize upgrades for any of the above projects you’re running.

Stay secure! :locked:

Questions or need config help? Post in Help.

2 Likes