EUVD-2026-101082Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown vulnerability trigger
-
ExploitUnknown impact on Gitea instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The specific exploitation conditions - including required authentication level, network position, feature configuration, or user interaction - are entirely unknown. No CVSS vector is available to infer attack vector or privilege requirements. The only confirmed fact is that the Alpine Linux package prior to 1.27.3-r0 is affected. Defenders cannot assess realistic exploitation likelihood without the upstream Gitea security advisory describing the vulnerability class and trigger conditions. |
| Impact | Risk assessment is severely constrained by the near-total absence of vulnerability metadata. No CVSS vector, no CWE, no EPSS score, no KEV listing, and no POC availability data are present. The vulnerability carries no confirmed active exploitation signal. Without CVSS metrics, the attack vector, complexity, required privileges, and impact dimensions cannot be evaluated. Real-world priority should be determined by the criticality of Gitea deployments in the organization and the sensitivity of repositories hosted; the lack of severity data should not be interpreted as low severity - it reflects missing data, not a benign finding. |
| Exploit ScenarioDerived | Because the vulnerability type, attack vector, and required conditions are entirely unknown, a realistic exploit scenario cannot be constructed from available data. No POC has been identified. Security teams should consult the upstream Gitea 1.27.3 changelog and any associated security advisories to determine the exploitability profile. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-62925. The nature, root cause, and impact class of the underlying vulnerability are not disclosed in available intelligence - the only confirmed data point is the Alpine Linux package remediation. Security teams running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly.
RemediationAI
Upgrade the Alpine Linux Gitea package to version 1.27.3-r0 or later using the Alpine package manager: 'apk upgrade gitea'. This is the only confirmed remediation signal. No upstream advisory URL or vendor patch link is available in the provided data. If immediate upgrade is not possible, consider restricting network access to the Gitea instance to trusted users and monitoring access logs for anomalous repository or administrative activity until the patch can be applied. No specific workaround is available given the unknown vulnerability class.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is an open-source, self-hosted Git service written in Go, commonly deployed on Alpine Linux in containerized and lightweight server environments. The Alpine Linux package 1.27.3-r0 corresponds to the upstream Gitea 1.27.3 release series. No CWE classification is provided, and the vulnerability's root cause class - whether it involves authentication, input validation, access control, or another category - is entirely unknown from available data.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB