Executive brief
Gitea vulnerable to Argument Injection in code.gitea.io/gitea
Affected products
- Go code.gitea.io/gitea
- Go github.com/go-gitea/gitea
Junglewise Threat Intelligence
CVE-2022-42968: GO-2022-1065 - Gitea vulnerable to Argument Injection in code.gitea.io/gitea
CVE-2022-42968 · Severity: low · CVSS 3.1 · Published 2024-08-21
Technologies: code.gitea.io/gitea (Go), github.com/go-gitea/gitea (Go). Vendors: Go.
Related threats
- Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- GO-2026-6074 - Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea
- GO-2026-6039 - Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata in gitea.dev
- Gitea public-only token scope bypass in Organization and Permission endpoints
- Gitea SSRF and local file read via migration asset bypass