EUVD-2026-101103Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker targets Gitea instance
-
ExploitTriggers undisclosed vulnerability
-
ImpactAchieves unknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No exploitation conditions can be extracted from the available data. The CVE record contains only a package-version fix notice with no description of the trigger, required configuration, authentication state, or deployment mode. No special conditions can be confirmed or ruled out. Defenders should assume any Gitea instance running an Alpine package older than 1.27.3-r0 may be affected. |
| Impact | Risk cannot be meaningfully assessed from the available data. No CVSS vector is present, so attack vector, complexity, privilege requirements, and impact dimensions are all unknown. EPSS score, KEV status, and POC availability are not reported. The sole signal confirming a real vulnerability is the Alpine Linux vendor fix in package version 1.27.3-r0. Without CVSS, CWE, or a technical description, defenders should treat this as an unknown-risk issue and prioritize patching based on the exposure of their Gitea instances - public-facing deployments warrant higher urgency. The absence of CVSSv3 data is itself a data quality concern. |
| Exploit ScenarioDerived | No exploit scenario can be constructed from the available data. The vulnerability type, attack vector, and required conditions are all undisclosed. Until a technical description or CVSS vector is published, the realistic attack path remains unknown. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, the self-hosted Git service, contains a vulnerability addressed in Alpine Linux package version 1.27.3-r0. The underlying nature of the flaw is undisclosed - no description, CVSS vector, or CWE has been published. The fix is confirmed via the Alpine Linux vendor advisory, but all technical details remain unavailable for independent analysis.
RemediationAI
Upgrade the Gitea Alpine Linux package to version 1.27.3-r0 or later using the Alpine package manager: 'apk upgrade gitea'. This is the only confirmed remediation step. Because the vulnerability type is unknown, no targeted compensating control can be recommended - generic mitigations such as restricting network access to the Gitea instance, enforcing authentication on all endpoints, and monitoring access logs represent prudent baseline hardening until technical details are disclosed. No workaround is documented in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is an open-source, self-hosted Git service written in Go, widely packaged in Linux distributions including Alpine Linux. The affected upstream Gitea version corresponds to the Alpine package 1.27.3-r0. Without a CWE classification or description, the root cause class - whether memory safety, authentication, injection, or another category - cannot be determined from available data. The CPE for the affected package is not provided in this record.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB