Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-70402Gitea local code execution through writable Git hooks

Medium 5.8

In plain English

A medium-severity incorrect permission assignment in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.2%top 91.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.27.2

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

References

GitHub Security Advisory GHSA-pq8x-xpgp-rvmh vendor-advisory
Gitea 1.27.3 release announcement release-notes
Fix: go-gitea/gitea pull request #39008 patch
Fix: go-gitea/gitea pull request #39016 patch
go-gitea/gitea v1.27.3 release release-notes