Repository Creation Field Validation Bypass in Gitea

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-22547

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 1.25.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Gitea versions before 1.25.5 and is due to the lack of validation constraints on repository creation fields. Specifically, fields such as length-limited template fields and values related to the trust model or object format are not properly validated.

Impact Analysis

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

This lack of validation could potentially allow malformed or malicious data to be entered during repository creation, which might lead to unexpected behavior or security issues within the application.

Hi! I’m here to help you understand CVE-2026-22547. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70