CVE-2022-30781: Gitea git fetch remote escaping flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityNetwork-reachable, no authentication or interaction required per the vector, public exploit write-ups exist, and EPSS is near the top percentile, though KEV does not list it.

What it is

Gitea before 1.16.7 does not escape the git fetch remote, allowing crafted input to reach command execution paths. The record is thin on technical detail, but the flaw is network-reachable and integrity-impacting, and public exploit write-ups exist. It matters because Gitea is a self-hosted code host, so compromise can expose repositories and credentials.

Impact

An attacker can achieve remote code execution on the Gitea server, gaining control of the host and any repositories, tokens or credentials it holds. The CVSS vector shows no confidentiality impact, but integrity is rated high, consistent with code or command execution.

Attack surface

Reached over the network via the git fetch remote functionality; the CVSS vector indicates no privileges and no user interaction are required. The description does not state which endpoint or role is needed, so that detail is missing.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.89361, 99.775th percentile) and multiple references are tagged Exploit, including Packet Storm remote code execution write-ups. This indicates public exploit material exists, though the record does not confirm active in-the-wild use.

What to do

• Upgrade Gitea to 1.16.7 or later, which contains the escaping fix.
• If immediate upgrade is not possible, restrict network access to the Gitea instance and limit who can trigger git fetch remote operations.
• Review the patch pull requests (19487, 19490) to understand the escaping change and check for equivalent gaps in custom integrations.
• Rotate credentials, tokens and SSH keys stored or used by the Gitea server if compromise is suspected.
• Monitor Gitea release notes for follow-up fixes in the same area.

Detection

• Alert on unexpected child processes spawned by the Gitea service account, especially shell or git commands with unusual arguments.
• Monitor Gitea application and web server logs for git fetch remote requests containing shell metacharacters or unusual remote URLs.
• Baseline outbound network connections from the Gitea host and flag connections to unknown or untrusted remotes.
• Watch for new files, cron entries or SSH authorized_keys changes on the Gitea host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.