CVE-2026-22547 is an input validation vulnerability in Gitea Open Source Git Server affecting versions before 1.25.5. The issue arises because repository creation fields, including length-limited template fields and trust model or object format values, lack proper validation constraints. This can allow an attacker to submit crafted inputs that compromise the confidentiality and integrity of the system. The vulnerability has a CVSS v3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to a complete compromise of confidentiality and integrity of the affected system. There is no impact on availability reported. The vulnerability can be exploited remotely without authentication or user interaction, making it highly severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided in the available data, users should monitor the Gitea project for updates and apply the official patch once released. Until then, consider restricting repository creation permissions to trusted users only as a temporary mitigation.