{"id":"CVE-2022-30781","details":"Gitea before 1.16.7 does not escape git fetch remote.","aliases":["BIT-gitea-2022-30781","GHSA-p5f9-c9j9-g8qx","GO-2022-0450"],"modified":"2026-08-12T03:51:22.234556191Z","published":"2022-05-16T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30781.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"http://packetstormsecurity.com/files/168400/Gitea-1.16.6-Remote-Code-Execution.html"},{"type":"WEB","url":"http://packetstormsecurity.com/files/169928/Gitea-Git-Fetch-Remote-Code-Execution.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/30xxx/CVE-2022-30781.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30781"},{"type":"FIX","url":"https://github.com/go-gitea/gitea/pull/19487"},{"type":"FIX","url":"https://github.com/go-gitea/gitea/pull/19490"},{"type":"ARTICLE","url":"https://blog.gitea.io/2022/05/gitea-1.16.7-is-released/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/go-gitea/gitea","events":[{"introduced":"0"},{"fixed":"f4729e241827574ba7ccedc48729487a527ddbae"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.16.7"}],"source":["DESCRIPTION","CPE_RANGE"],"cpe":"cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*"}}],"versions":["v1.16.6","v1.16.5","v1.16.4","v1.16.3","v1.16.2","v1.16.1","v1.16.0","v1.16.0-rc1","v1.15.0-rc1","v1.16.0-dev","v1.15.0-dev","v1.14.0-dev","v1.13.0-dev","v1.12.0-dev","v1.10.5","v1.11.0-rc1","v1.10.0-rc1","v1.11.0-dev","v1.9.0-rc1","v1.10.0-dev","v1.9.0-dev","v1.7.0-dev","v1.6.0-rc1","v1.6.0-dev","v1.5.0-rc1","v1.5.0-dev","v1.1.0","v1.0.0","v0.9.99"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-30781.json"}}],"schema_version":"1.9.0"}