Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-70402— Gitea local code execution through writable Git hooks

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Gitea 创建服务器端 Git 钩子（hooks）目录及脚本时，文件权限模式设置为 0777，并依赖于进程 umask 来限制访问权限。当 umask 设置为较为宽松的值（如 0000 或 0002）时，同一台服务器上的其他本地用户若能够访问仓库存储目录，便可修改已有的钩子文件或向可写的钩子目录中添加可执行文件。在后续执行 Git 操作时，系统将以 Gitea 服务账户的身份执行该文件，从而导致潜在的安全风险。

AI Predicted 7.3 Difficulty: Moderate EPSS 0.19% · P8

Affected Version Matrix 1

VendorProduct Version RangeStatus
Gitea Gitea ≤ 1.27.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-70402

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea local code execution through writable Git hooks
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 0 ~ 1.27.2 -

II. Public POCs for CVE-2026-70402

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-70402

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-70402 (2)

Other References for CVE-2026-70402 (2)

Other References for CVE-2026-70402 (1)

Same Patch Batch · Gitea · 2026-10-14 · 36 CVEs total

CVE-2026-68964 Gitea restricted-user SSH and GPG key metadata disclosure
CVE-2026-70407 Gitea organization listing token scope bypass
CVE-2026-70396 Gitea organization repository creation token scope bypass
CVE-2026-70406 Gitea private comparison disclosure with public-only tokens
CVE-2026-70400 Gitea private migration creation with public-only tokens
CVE-2026-67577 Gitea restricted-user activity and heatmap disclosure
CVE-2026-63792 Gitea private reusable workflow disclosure to fork runs
CVE-2026-63021 Gitea Swift package manifest memory exhaustion
CVE-2026-62925 Gitea Alpine package parsing memory exhaustion
CVE-2026-59774 Gitea Org-mode file disclosure and code execution
CVE-2026-68957 Gitea restricted-user issue search disclosure
CVE-2026-73814 Gitea repository ownership escalation by administrators
CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target
CVE-2026-73535 Gitea second-factor bypass through OpenID identity linking
CVE-2026-73804 Gitea API token scope escalation through HTTP signatures
CVE-2026-73539 Gitea external renderer argument injection and code execution
CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification
CVE-2026-78433 Gitea private attachment disclosure through repository mismatch
CVE-2026-73130 Gitea repository initialization resource exhaustion
CVE-2026-73802 Gitea Runner host isolation bypass through container options

Showing top 20 of 36 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-732

V. Comments for CVE-2026-70402

No comments yet

Leave a comment