Gitea versions before 1.25.5 lack input validation for fields used during repository creation, such as template descriptors and trust model tags. The missing checks allow an attacker to submit data that exceeds expected lengths or contains unsupported format values, which can trigger application errors, excessive resource consumption, or incorrect assignment of trust settings. This flaw is classified as CWE‑20, improper input validation.

Any deployment of Gitea Open Source Git Server running a version earlier than 1.25.5 is affected. The issue is resolved in release 1.25.5 and later versions, so those releases are not vulnerable.

The CVSS score of 9.1 indicates high severity. The EPSS score of <1% suggests that the likelihood of a publicly available exploit is low at present. The vulnerability is not included in the CISA KEV catalog. Exploitation would require the ability to invoke the repository creation API with arbitrary values; this entry is inferred from the description of the vulnerable code path. While no public exploit has been reported, the high severity and potential impact warrant prompt remediation.