CVE-2026-70402 — Gitea local code execution through writable Git hooks
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, anoth…
Published: 2026-10-14 · CVSS: 5.8 · CVSS 3.1
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7