Server-Side Git Hook Security Flaw in Gitea by Gitea
CVE-2026-70402

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-70402?

Gitea has a security issue where it creates server-side Git hook directories and scripts with overly permissive permissions (mode 0777). This reliance on the process umask allows local users with access to the repository storage to potentially modify existing hooks or introduce malicious executables. Such actions could lead to unauthorized code execution during subsequent Git operations performed under the Gitea service account, thereby compromising the integrity of the system.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39008
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/What-canIsay
https://github.com/bircni
https://github.com/silverwind
.