GHSA-922f-hfwp-p56f

Gitea repository creation accepts insufficiently validated fields

En bref

Publiée: 2026-07-03 21:31 UTC
Mise à jour: 2026-09-02 19:55 UTC
CVE: CVE-2026-22547
Alias: GO-2026-6338
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

Paquets affectés

Paquet	Versions
Go · code.gitea.io/gitea	introduced 0, fixed 1.25.5

Références

https://nvd.nist.gov/vuln/detail/CVE-2026-22547 ADVISORY
https://github.com/go-gitea/gitea/pull/36671 WEB
https://github.com/go-gitea/gitea/pull/36757 WEB
https://github.com/go-gitea/gitea/commit/569c49debe06f30a2bbb50b3812e705c556b8adf WEB
https://github.com/go-gitea/gitea/commit/b3bc79262d106f4259f82a26609e4738b618152b WEB
https://blog.gitea.com/release-of-1.25.5 WEB
https://github.com/go-gitea/gitea PACKAGE
https://github.com/go-gitea/gitea/releases/tag/v1.25.5 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database