PT-2022-20314 · Gitea+1 · Gitea+1

6543 · Published 2022-01-22 · Updated 2025-11-26 · CVE-2022-30781

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gitea versions 1.16.6 and prior

Description The issue is related to the improper handling of git fetch, allowing for shell command injection. This is due to the lack of escaping for the git fetch remote. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Gitea versions 1.16.6 and prior, update to version 1.16.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the git fetch remote functionality until a patch is available. Avoid using the git fetch remote command in the affected versions until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

ALT-PU-2022-1116

ALT-PU-2022-1210

ALT-PU-2022-1753

ALT-PU-2022-1808

ALT-PU-2022-1825

ALT-PU-2022-1884

ALT-PU-2022-2311

ALT-PU-2022-2358

ALT-PU-2022-3074

BIT-GITEA-2022-30781

CVE-2022-30781

GHSA-P5F9-C9J9-G8QX

GO-2022-0450

Affected Products

Alt Linux

Gitea

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitea_git_fetch_rce.rb · Exploit
• 🔥 https://github.com/wuhan005/CVE-2022-30781 · Exploit
• 🔥 https://exploit-db.com/exploits/51009 · Exploit
• 🔥 http://packetstormsecurity.com/files/168400/Gitea-1.16.6-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/169928/Gitea-Git-Fetch-Remote-Code-Execution.html · Exploit
• https://github.com/go-gitea/gitea/pull/19490 · Patch
• https://github.com/go-gitea/gitea/pull/19487 · Patch
• https://osv.dev/vulnerability/CVE-2022-30781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30781 · Security Note
• https://osv.dev/vulnerability/GO-2022-0450 · Vendor Advisory
• https://blog.gitea.io/2022/05/gitea-1.16.7-is-released · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p5f9-c9j9-g8qx · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitea-2022-30781 · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://t.me/freedomf0x/17490 · Telegram Post