Skip to content
OpenAdvisories

Vendor

Gitea

210 known vulnerabilities.

Products

Gitea 111 Gitea Open Source Git Server 97 Gitea Runner 1 act_runner 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-59774 Public exploit Scanner template EPSS 28%

    Gitea Org-mode file disclosure and code execution

    Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea ser…

    Gitea Gitea
  • Critical 9.8
    CVE-2026-60004 Exploited Public exploit Scanner template EPSS 24%

    Gitea: Remote Code Execution via diffpatch Git Hook Installation

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Gitea Gitea code.gitea.io/gitea gitea Alpine Wolfi Go
    KEV Aug 25, 2026
  • Critical 9.6
    CVE-2026-22874 Public exploit

    Gitea webhook and migration allow-list filtering permits SSRF

    Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go
  • Critical 9.8
    CVE-2026-20896 Public exploit Scanner template

    Gitea Docker image trusts spoofable reverse-proxy headers by default

    Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

    Gitea Gitea Open Source Git Server code.gitea.io/gitea Go