CVE-2022-27313: Arbitrary File Deletion in Gitea
Summary
CVE-2022-27313: Arbitrary file deletion in gitea. Affects code.gitea.io/gitea versions < 1.16.4. Fixed in 1.16.4. How to fix ↓
Also tracked for
- gitea · Bitnami
The same CVE-2022-27313 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service written in Go. It provides a lightweight interface for managing repositories, users, and organizations. Gitea is widely used for version control and collaboration in software development projects. However, a vulnerability has been discovered in Gitea version 1.16.3 that allows attackers to delete arbitrary files, leading to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in Gitea v1.16.3 allows attackers to delete the configuration file, resulting in a DoS attack. By exploiting this vulnerability, an attacker can disrupt the normal functioning of Gitea by removing critical configuration settings. This can lead to service downtime and potential data loss. The vulnerability is rated as HIGH severity with a CVSS score of 7.5.
How To Fix
Latest published version: v1.26.4 as of 22 Oct 2026
go get code.gitea.io/gitea@v1.26.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16.4
This is the first release that contains the fix.
go get code.gitea.io/gitea@v1.16.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch by upgrading to Gitea version 1.16.4 or later.
Conclusion
The vulnerability in Gitea v1.16.3 allows attackers to delete the configuration file, leading to a Denial of Service (DoS) attack. To mitigate this vulnerability, it is crucial to upgrade Gitea to version 1.16.4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for code.gitea.io/gitea →
FAQ
The vulnerability allows attackers to delete the configuration file, causing a DoS attack and potential data loss.
You can use Vulert's playground at Vulert Scanner to check if your Gitea installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, the Gitea development team has released a fix in version 1.16.4. It is recommended to upgrade to the latest version to mitigate the vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the patched version is the recommended solution.
The vulnerability is rated as HIGH severity with a CVSS score of 7.5.
Related vulnerabilities
Recent vulnerabilities recorded for code.gitea.io/gitea.
