{"id":"CVE-2022-30781","published":"2022-05-16T00:00:00Z","modified":"2024-08-03T06:56:14Z","title":"Gitea before 1.16.7 does not escape git fetch remote","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Gitea before 1.16.7 does not escape git fetch remote.","provenance":"source","from":"CVE.org"},"summary":{"text":"Gitea versions before 1.16.7 fail to properly escape the remote argument passed to the git fetch command, leaving the flaw in how the application handles git fetch remotes.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:42Z"},"cvss":null,"epss":{"score":0.8793,"percentile":0.99763,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://github.com/go-gitea/gitea/pull/19490","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/19487","tags":[]},{"url":"https://blog.gitea.io/2022/05/gitea-1.16.7-is-released/","tags":[]},{"url":"http://packetstormsecurity.com/files/168400/Gitea-1.16.6-Remote-Code-Execution.html","tags":[]},{"url":"http://packetstormsecurity.com/files/169928/Gitea-Git-Fetch-Remote-Code-Execution.html","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"code.gitea.io/gitea","vulnerableRanges":["<1.16.7"],"patched":["1.16.7"],"from":["GHSA-p5f9-c9j9-g8qx","GO-2022-0450"],"provenance":"source"}],"advisories":[{"id":"GHSA-p5f9-c9j9-g8qx","url":"https://github.com/advisories/GHSA-p5f9-c9j9-g8qx","severity":"HIGH","ecosystem":"Go","package":"code.gitea.io/gitea","vulnerableRanges":["<1.16.7"],"patched":["1.16.7"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-4684","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4684","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":51009,"url":"https://www.exploit-db.com/exploits/51009","title":"Gitea 1.16.6 - Remote Code Execution (RCE) (Metasploit)","type":"webapps","platform":"multiple","date":"2022-09-15","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-09-15"},"pocGithub":{"count":2,"skipped":0,"earliest":"2022-05-22","earliestUrl":"https://github.com/wuhan005/CVE-2022-30781","repos":[{"name":"wuhan005/CVE-2022-30781","url":"https://github.com/wuhan005/CVE-2022-30781","stars":86,"created":"2022-05-22"},{"name":"403ArkhamS3c/cve-gitea","url":"https://github.com/403ArkhamS3c/cve-gitea","stars":1,"created":"2026-10-28"}]},"metasploit":[{"name":"Gitea Git Fetch Remote Code Execution","module":"exploit/multi/http/gitea_git_fetch_rce","type":"exploit","disclosureDate":"2022-05-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitea_git_fetch_rce.rb"}],"first":{"date":"2022-05-16","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitea_git_fetch_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/168400/Gitea-1.16.6-Remote-Code-Execution.html","http://packetstormsecurity.com/files/169928/Gitea-Git-Fetch-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2022-05-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-30781","provenance":"source"},{"date":"2022-05-16","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-05-22, Exploit-DB 2022-09-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gitea_git_fetch_rce.rb","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":25.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9976"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 NVD exploit links; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2022-0905","published":"2022-03-10","fixed":"1.16.4","kev":false},{"cve":"CVE-2022-27313","published":"2022-05-03","fixed":"1.16.4","kev":false},{"cve":"CVE-2022-1058","published":"2022-03-24","fixed":"1.16.5","kev":false,"link":{"from":"CVE-2022-1058","to":"CVE-2022-30781","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:code.gitea.io/gitea","fromFixed":"1.16.5","toFixed":"1.16.7","daysApart":53}]}},{"cve":"CVE-2022-30781","published":"2022-05-16","fixed":"1.16.7","kev":false},{"cve":"CVE-2022-1928","published":"2022-05-29","fixed":"1.16.9","kev":false,"link":{"from":"CVE-2022-30781","to":"CVE-2022-1928","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:code.gitea.io/gitea","fromFixed":"1.16.7","toFixed":"1.16.9","daysApart":13}]}},{"cve":"CVE-2022-38183","published":"2022-08-12","fixed":"1.16.9","kev":false,"link":{"from":"CVE-2022-30781","to":"CVE-2022-38183","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:code.gitea.io/gitea","fromFixed":"1.16.7","toFixed":"1.16.9","daysApart":88}]}},{"cve":"CVE-2022-38795","published":"2023-08-07","fixed":"1.17.2","kev":false}],"package":"Go:code.gitea.io/gitea"}}