Gitea Repository Creation Vulnerability: Critical CVE Alert
- Severity
- HIGH
- Affected component
- gitea (go)
- Affected versions
- < 1.25.5
- Patched version
- 1.25.5
An early warning has been issued for a critical vulnerability in Gitea versions before 1.25.5. This vulnerability, tracked as GHSA-922F-HFWP-P56F, involves insufficient validation of repository creation fields.
What happened
Gitea versions before 1.25.5 reportedly lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values. This vulnerability, identified as CVE-2026-22547, is under investigation. It is not yet confirmed if this vulnerability has been exploited in the wild. Users of affected versions are advised to take immediate action to mitigate potential risks.
The vulnerability was first flagged on July 3, 2026, and has been published to the GitHub Advisory Database. The affected component is the gitea (go) package, with versions before 1.25.5 being vulnerable. The patched version is 1.25.5. Users should consult the primary sources for the most up-to-date information and recommendations.
What to do about it
- Upgrade to Gitea version 1.25.5 or later to mitigate the vulnerability.
- Review your Gitea configuration and repository creation processes to ensure they align with the updated validation constraints.
- Monitor the primary sources for any updates or additional recommendations related to this vulnerability.
How 0Day would have caught this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Gitea versions before 1.25.5, you are affected by this vulnerability.
What should I do right now?
Upgrade to Gitea version 1.25.5 or later immediately. Review your configuration and processes to align with the updated validation constraints.
Is this vulnerability being exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time. However, it is under investigation.