Vulnerability record · CVE-2020-14144 · published 16 October 2020
CVE-2020-14144: Gitea git hook feature allows authenticated remote code execution
Gitea · Gitea
Gitea 1.1.0 through 1.12.5 ships a git hook feature that can execute arbitrary commands on the server when enabled. The vendor disputes this as a vulnerability, arguing it is intended functionality restricted to a very limited subset of privileged accounts and covered by warnings in the documentation. The dispute matters because defenders must decide whether to treat hook execution as a misconfiguration risk or a code flaw.
Description
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer environments where the documentation was not understood (e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the ENABLE_GIT_HOOKS line in the config file). NOTE: The vendor has indicated this is not a vulnerability and states "This is a functionality of the software that is limited to a very limited subset of accounts. If you give someone the privilege to execute arbitrary code on your server, they can execute arbitrary code on your server. We provide very clear warnings to users around this functionality and what it provides.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.2 and an EPSS above the 99th percentile with public exploit references make this worth urgent attention, even though the vendor disputes it and exploitation requires high privileges.
What it is
Gitea 1.1.0 through 1.12.5 ships a git hook feature that can execute arbitrary commands on the server when enabled. The vendor disputes this as a vulnerability, arguing it is intended functionality restricted to a very limited subset of privileged accounts and covered by warnings in the documentation. The dispute matters because defenders must decide whether to treat hook execution as a misconfiguration risk or a code flaw.
Impact
An attacker with an account holding the privilege to configure git hooks gains arbitrary command execution on the Gitea server, with high impact to confidentiality, integrity and availability. The vendor's position is that such an account already has code execution by design.
Attack surface
Reached over the network through the Gitea web interface or repository hook configuration, requiring high privileges (PR:H) and no user interaction. The CVSS vector is AV:N/AC:L/PR:H/UI:N/S:U, so only authenticated accounts with hook permissions can reach it.
Exploitation
Not listed in CISA KEV, but EPSS is very high at 0.95357 (99.864th percentile) and public exploit references exist, including a Packet Storm advisory and GitHub proof-of-concept material. The record does not state whether exploitation has been observed in the wild.
What to do
- Upgrade Gitea to a release after 1.12.5; check the project release notes for the version that changes hook handling.
- Disable or restrict the git hook feature (ENABLE_GIT_HOOKS) unless it is explicitly required.
- Limit hook configuration privileges to the smallest possible set of trusted accounts and review who currently holds them.
- Run Gitea with least privilege and isolate it so that command execution does not reach sensitive hosts or data.
- Document and communicate the risk of the hook feature to administrators so it is not enabled unintentionally.
Detection
- Monitor Gitea audit and application logs for changes to repository hook configuration or hook files.
- Alert on new or modified hook scripts in Gitea repository directories and on unexpected child processes spawned by the Gitea service account.
- Review accounts with hook or repository administration privileges for unexpected grants or use.
- Correlate Gitea web requests to hook configuration endpoints with subsequent process execution on the host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-14144 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-14144), CISA KEV, FIRST EPSS (scores of 2026-09-23). This page is refreshed as NVD updates the record.
