Skip to content
OpenAdvisories

Package · Go

code.gitea.io/gitea

123 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-60004 Exploited Public exploit EPSS 24%

    Gitea: Remote Code Execution via diffpatch Git Hook Installation

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Gitea Gitea code.gitea.io/gitea gitea.dev Alpine Go
    KEV Aug 25, 2026
  • High 8.9
    CVE-2026-58424 Public exploit

    Permanent Fork PR Workflow Approval Gate Bypass

    Permanent Fork PR Workflow Approval Gate Bypass

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 8.1
    CVE-2026-28699 Public exploit

    Gitea Basic Auth bypasses OAuth2 access token scopes

    Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 8.2
    CVE-2026-27771 Public exploit

    Gitea Composer package source links use insufficient permission checks

    Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Critical 9.6
    CVE-2026-22874 Public exploit

    Gitea webhook and migration allow-list filtering permits SSRF

    Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Critical 9.8
    CVE-2026-20896 Public exploit

    Gitea Docker image trusts spoofable reverse-proxy headers by default

    Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • High 7.5
    CVE-2022-30781 Public exploit EPSS 88%

    Shell command injection in gitea

    Gitea before 1.16.7 does not escape git fetch remote.

    code.gitea.io/gitea gitea Alpine Go
  • Low 3.7
    CVE-2021-28378 Public exploit

    Cross-site Scripting in Gitea

    Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.

    code.gitea.io/gitea gitea Alpine Go
  • High 7.2
    CVE-2020-14144 Public exploit EPSS 95%

    Arbitrary Code Execution in Gitea

    The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented imme…

    code.gitea.io/gitea Go