New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands

Swati KhandelwalJul 29, 2026Vulnerability / DevOps

Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account.

Tracked as CVE-2026-60004 (CVSS score: 9.8), the flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1. The vulnerable API call requires authentication and repository write permission. But Gitea enables registration by default, so an outside visitor can create a normal account and repository on an unchanged installation, then exploit the bug without pre-existing credentials.

Upgrading to 1.27.1 is the fix. Gitea said on July 27 that Gitea Cloud instances would be upgraded automatically. Gitea's July 28 advisory does not say the flaw has been exploited in the wild, but it includes public proof-of-concept (PoC) code.

Disabling open registration can remove the public account-creation path while the update is deployed, but it does not fix the flaw or protect against existing users with repository write access.

New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands

Related reading

Gitea Vulnerability Exposed 30,000 Deployments to Attacks

Critical Gitea Flaw Under Active Exploitation, Researchers Warn

Hackers exploit critical auth bypass in Gitea Docker image

Gitea Vulnerability Exposes Private Container Images without Authentication

One Header, Full Admin: Attackers Exploit Critical Auth Bypass in Gitea Docker…

Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure