[ CVE-2026-70402 · Published 14 Oct 2026 ]
Vulnerability in Gitea
CVSS 5.8
EPSS <1%No fix listed yet
[ Description ]Official description
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.