All vulnerabilities
CVE-2026-70402GHSA-pq8x-xpgp-rvmh

Gitea local code execution through writable Git hooks

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
5.8Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.27.3Fixed versionGitHub
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

  • 1.27.3code.gitea.io/gitea, goGitHubgo get code.gitea.io/gitea@v1.27.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 1.27.2CVE List
  • code.gitea.io/gitea, go<= 1.27.2GitHub

References 5