Gitea, a widely-used self-hosted Git platform, has addressed a serious remote code execution vulnerability that affected its software. This flaw, identified as CVE-2026-60004, allows users with standard repository write access to execute shell commands by manipulating Git hooks. Rated with a CVSS score of 9.8, the vulnerability was found in versions 1.17 and later, up to 1.27.0. The issue has been resolved in version 1.27.1.
Implications of the Vulnerability
The critical flaw requires authentication and repository write permissions to exploit, yet Gitea’s default settings permit public registration. This means that an external user could create an account and exploit the vulnerability without pre-existing credentials. The vulnerability was disclosed by security researcher Shai Rod, known as NightRang3r, who reported it to Gitea.
In response, Gitea announced on July 27 that all Gitea Cloud instances would receive automatic updates. Although no active exploitation of this vulnerability has been reported, a public proof-of-concept (PoC) is available. Disabling open registration can mitigate some risks while updates are applied, but it doesn’t address the root cause for existing users with write access.
Technical Details and Exploitation
The vulnerability resides in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, where a patch can be applied to a shared temporary clone. Vulnerable versions use the Git command with specific options, leading to an add/add collision when the same patch is applied twice. This behavior allows malicious code to be executed by placing a file in Git’s hook directory.
An attacker can exploit this by using a normal account to create a private repository, applying the patch twice, and accessing command outputs stored in Git objects. The execution grants the attacker the same privileges as the Gitea service account, potentially exposing sensitive data such as application secrets, database credentials, and internal services.
Security Measures and Recommendations
To mitigate the vulnerability, users should upgrade to Gitea version 1.27.1, which changes the temporary clone from bare to non-bare, preventing the exploit. It’s essential to review the changelog for this update, as the fix might not be prominently highlighted. Additionally, administrators should consider restricting registration and monitoring for unusual activities in their repositories.
Looking forward, Gitea has made adjustments to prevent similar issues, such as modifying its Org-mode renderer to return #+INCLUDE paths as plain text. While this particular file-inclusion issue has not been assigned a CVE, it reflects ongoing security enhancements in the platform.
By staying informed and promptly applying security patches, organizations can protect their systems against potential threats and ensure the integrity and security of their code repositories.
