A repository created with auto-init accepted pushes before its initialization had finished, and the initial commit was built in a checkout of whatever the repository already contained. A user who is allowed to create repositories could push a crafted tree during that window so that writing the README followed a symbolic link and overwrote a server-side git hook, which runs commands as the Gitea system user. The initial commit is now built in a freshly initialized directory, and a new repository only becomes ready, and accepts pushes, once its initialization is complete.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sun, 15 Nov 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A repository created with auto-init accepted pushes before its initialization had finished, and the initial commit was built in a checkout of whatever the repository already contained. A user who is allowed to create repositories could push a crafted tree during that window so that writing the README followed a symbolic link and overwrote a server-side git hook, which runs commands as the Gitea system user. The initial commit is now built in a freshly initialized directory, and a new repository only becomes ready, and accepts pushes, once its initialization is complete. | |
| Title | Gitea command execution through repository auto-initialization | |
| Weaknesses | CWE-362 CWE-59 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-11-15T21:10:23.428Z
Reserved: 2026-11-15T20:29:37.607Z
Link: CVE-2026-125423
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-15T21:16:54.590
Modified: 2026-11-15T21:16:54.727
Link: CVE-2026-125423
Redhat
No data.
OpenCVE Enrichment
No data.