Gitea Patches Critical RCE Flaw Allowing Shell Command Execution

Gitea, the popular self-hosted Git platform, has addressed a critical remote code execution (RCE) vulnerability that allowed users with ordinary repository write access to execute arbitrary shell commands on the server. This flaw, tracked as CVE-2026-60004, carried a high CVSS score of 9.8, indicating its severity. The vulnerability enabled an attacker to craft malicious patch content that, when processed, could be leveraged to plant a Git hook. This hook would then execute shell commands with the privileges of the Gitea service account, potentially leading to full system compromise.

The vulnerability specifically impacted Gitea versions 1.17 and all subsequent versions up to, but not including, 1.27.1. The Gitea security team released version 1.27.1 on March 19, 2024, to rectify this critical security issue. Users are strongly advised to update to Gitea version 1.27.1 or later as soon as possible to mitigate the risk of exploitation. The nature of the exploit involves manipulating patch content, a core feature of Git for managing code changes. By embedding malicious instructions within a patch, an attacker could trick the Git hook mechanism into running unauthorized code. Git hooks are scripts that run automatically at certain points in the Git workflow, such as before a commit or after a push. In this instance, the vulnerability allowed an attacker to effectively inject a malicious script into the Git hook execution process.

This discovery highlights ongoing security challenges within software development platforms that handle sensitive code repositories. Gitea, known for its open-source nature and self-hosting capabilities, is utilized by numerous individuals and organizations for version control. The ability for a user with write access to escalate privileges and execute commands on the server represents a significant security breach. The CVSS score of 9.8 places this vulnerability among the most severe, requiring immediate attention from administrators. The fix in version 1.27.1 involves stringent validation and sanitization of patch content to prevent the unintended execution of shell commands. The Gitea project has a history of addressing security concerns, and this patch is a testament to their commitment to maintaining platform integrity. The company's advisory emphasized the importance of prompt updates for all users operating affected versions of the software to safeguard their repositories and server infrastructure from potential attacks.