CVE-2026-70402: Gitea local code execution through writable Git hooks
Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. A later Git operation can execute that file as the Gitea service account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances are exposed when Gitea runs with a permissive process umask, such as 0000 or 0002, and another local user can access the repository storage. The issue requires local access; the provided information does not indicate a remote-only attack path.
What must an attacker do to exploit it?
An attacker needs local access sufficient to reach the repository storage and modify a server-side Git hook or place an executable in a writable hook directory. A subsequent Git operation must then run and execute the attacker-controlled file as the Gitea service account.
Are default permissions necessarily affected?
No. Gitea creates the relevant hook directories and scripts with mode 0777, but relies on the service process umask to restrict effective access. Exposure depends on the configured umask being permissive, such as 0000 or 0002.
What can be done if patching is not immediately possible?
Restrict local users' access to Gitea repository storage and ensure the Gitea service does not use a permissive umask. Review hook directories and scripts for unauthorized modifications or unexpected executables before allowing further Git operations.