CVE-2026-22547

Published: Jul 3, 2026Modified: Jul 7, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://blog.gitea.com/release-of-1.25.5/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/36671

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/36757

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.25.5

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

Timeline

No history available yet.