GO · JULY 2026 · EARLY WARNING

Gitea Repository Creation Vulnerability: Critical CVE Alert

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
gitea (go)
Affected versions
< 1.25.5
Patched version
1.25.5
GHSA-922F-HFWP-P56F

An early warning has been issued for a critical vulnerability in Gitea versions before 1.25.5. This vulnerability, tracked as GHSA-922F-HFWP-P56F, involves insufficient validation of repository creation fields.

What happened

Gitea versions before 1.25.5 reportedly lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values. This vulnerability, identified as CVE-2026-22547, is under investigation. It is not yet confirmed if this vulnerability has been exploited in the wild. Users of affected versions are advised to take immediate action to mitigate potential risks.

The vulnerability was first flagged on July 3, 2026, and has been published to the GitHub Advisory Database. The affected component is the gitea (go) package, with versions before 1.25.5 being vulnerable. The patched version is 1.25.5. Users should consult the primary sources for the most up-to-date information and recommendations.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using Gitea versions before 1.25.5, you are affected by this vulnerability.

What should I do right now?

Upgrade to Gitea version 1.25.5 or later immediately. Review your configuration and processes to align with the updated validation constraints.

Is this vulnerability being exploited in the wild?

There is no confirmed report of this vulnerability being exploited in the wild at this time. However, it is under investigation.

Sources

Join the 0Day waitlist →

← Back to all threats