CVE-2018-18926: Remote Code Execution (RCE) in code.gitea.io/gitea
Summary
CVE-2018-18926: Gitea Remote Code Execution (RCE). Affects code.gitea.io/gitea versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
code.gitea.io/gitea is an open-source Git service written in Go. It provides a self-hosted platform for managing Git repositories, user authentication, and collaboration features. The vulnerability identified as CVE-2018-18926 allows remote code execution due to improper validation of session IDs in the go-macaron/session code for Macaron.
Vulnerability Detail
The vulnerability in code.gitea.io/gitea allows an attacker to execute arbitrary code remotely. By exploiting the improper validation of session IDs, an attacker can gain unauthorized access to the system and execute malicious code. This can lead to various consequences, including data theft, privilege escalation, and further compromise of the affected system. The vulnerability has a CVSS score of 8.1, indicating a critical severity level.
How To Fix
Latest published version: v1.26.4 as of 22 Oct 2026
go get code.gitea.io/gitea@v1.26.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.2
This is the first release that contains the fix.
go get code.gitea.io/gitea@v1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to disable the affected functionality or restrict access to the vulnerable system. This can be achieved by modifying the configuration settings or implementing network-level controls. However, applying the official fix by updating to the latest version is strongly advised.
Conclusion
The vulnerability CVE-2018-18926 in code.gitea.io/gitea allows remote code execution, posing a significant risk to the affected systems. To mitigate this vulnerability, it is crucial to update code.gitea.io/gitea to version 1.5.4 or later. Regularly updating the software and applying security patches is essential for maintaining a secure environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for code.gitea.io/gitea →
FAQ
code.gitea.io/gitea is an open-source Git service written in Go. It provides a self-hosted platform for managing Git repositories, user authentication, and collaboration features.
The vulnerability allows remote code execution, enabling an attacker to execute arbitrary code on the affected system. This can lead to data theft, privilege escalation, and further compromise of the system.
To fix this vulnerability, update code.gitea.io/gitea to version 1.5.4 or later. Regularly updating the software is important to apply the latest security patches.
A temporary workaround is to disable the affected functionality or restrict access to the vulnerable system. However, it is strongly recommended to apply the official fix by updating to the latest version.
The vulnerability has a CVSS score of 8.1, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for code.gitea.io/gitea.
