CVE-2026-125423
Deferred Deferred - Pending Action

Gitea Repository Initialization Race Condition Allows Hook Overwrite

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: Gitea Limited

Description
A repository created with auto-init accepted pushes before its initialization had finished, and the initial commit was built in a checkout of whatever the repository already contained. A user who is allowed to create repositories could push a crafted tree during that window so that writing the README followed a symbolic link and overwrote a server-side git hook, which runs commands as the Gitea system user. The initial commit is now built in a freshly initialized directory, and a new repository only becomes ready, and accepts pushes, once its initialization is complete.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-125423
EUVD
EUVD-2026-126115

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea From 0 (inc) to 28.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-125423 is a vulnerability in Gitea where a repository created with auto-init could accept pushes before initialization finished. An attacker could push a crafted Git repository with a symlink as README.md pointing to a server-side hook file. If the push completes before initialization, the system overwrites the hook with user-controlled content. When initialization finishes, the compromised hook executes with Gitea service account privileges, enabling remote code execution.

Detection Guidance

Check Gitea server logs for unusual repository creation events or unexpected hook executions. Look for repositories created with auto_init enabled that were marked ready before initialization completed. Verify if any user pushed a crafted repository during the race window.

Impact Analysis

This vulnerability allows an authenticated user who can create repositories to execute arbitrary commands on the server with the privileges of the Gitea service account. This could lead to full system compromise, data theft, or disruption of services. Exploitation requires winning a race condition but does not need admin rights or SSH access.

Compliance Impact

This vulnerability could lead to unauthorized code execution on the server, potentially exposing sensitive data regulated by GDPR or HIPAA. A successful exploit may result in data breaches, unauthorized access, or loss of data integrity, violating compliance requirements for data protection and security.

Mitigation Strategies

Upgrade Gitea to version 28.4.0 or later immediately. Disable repository auto-init for non-administrative users until patched. Monitor for signs of exploitation such as unexpected hook executions or unauthorized command runs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125423. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...