CVE-2019-11229: Gitea mirror repo URL handling allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with a public exploit and very high EPSS percentile, though it requires an authenticated low-privileged account and is not in KEV.

What it is

Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repository URL settings, allowing an authenticated user to trigger remote code execution. The flaw is in models/repo_mirror.go and is rated high severity (CVSS 3.1 8.8). It matters because a low-privileged account can gain full control of confidentiality, integrity and availability on the host.

Impact

An attacker with a valid account gains code execution on the Gitea server, leading to full compromise of data and service integrity. The CVSS vector indicates high impact to confidentiality, integrity and availability.

Attack surface

Reached over the network through the mirror repository URL configuration; the vector requires low privileges (PR:L) and no user interaction (UI:N). No authentication bypass is implied, so a valid low-privileged account is needed.

Exploitation

Not listed in CISA KEV, but a public exploit exists (Packet Storm reference tagged Exploit) and EPSS is 0.54955 (98.9th percentile), indicating elevated likelihood of exploitation.

What to do

• Upgrade Gitea to 1.7.6 or later, or 1.8.0-RC3 or later, per the vendor release notes.
• Restrict who can create or configure mirror repositories to trusted users only.
• Review existing mirror repository URL settings for unexpected or attacker-controlled values.
• Monitor and limit outbound network access from the Gitea host to reduce post-exploitation reach.

Detection

• Audit Gitea logs for mirror repository creation or URL changes made by low-privileged accounts.
• Alert on unexpected child processes or outbound connections spawned by the Gitea service.
• Review repository mirror configuration changes around the time of any suspected compromise.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.