Description

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T20:17:56.010Z",
  "pubdate": "2026-08-26T20:17:56.010Z",
  "executiveSummary": "Gitea versions prior to 1.27.1 contain a critical vulnerability in the diffpatch API that permits unauthenticated or unauthorized remote code execution (RCE).\nThe vulnerability stems from improper input validation within the diffpatch mechanism, which allows an attacker to manipulate the underlying Git configuration of a repository.\nBy leveraging this flaw, an adversary can facilitate the installation of arbitrary Git hooks.\nBecause Git hooks are executable scripts that run on the server side during repository events, this effectively grants the attacker full command execution capabilities within the security context of the Gitea service.\nThe vulnerability poses a severe risk to the integrity, availability, and confidentiality of the host system, as successful exploitation enables persistent backdoors, data exfiltration, and lateral movement within the infrastructure.\nAttackers do not require deep technical sophistication to trigger the vulnerability if the API endpoint is reachable, making this a high-priority threat for organizations hosting Gitea instances.",
  "technicalDetails": "The vulnerability resides within the Gitea diffpatch API, a component designed to handle patch applications and repository synchronization. The root cause is a failure to sufficiently sanitize input parameters when processing diffpatch requests, enabling an attacker to perform unintended file system operations.\nThe exploitation flow initiates by sending a crafted request to the diffpatch endpoint. By manipulating the patch payload, an attacker can bypass intended directory restrictions to interact with the hidden .git directory located at the root of a repository.\nSpecifically, the vulnerability allows for the injection or overwriting of files within the hooks directory (e.g., hooks/post-receive or hooks/pre-receive). In Git architecture, hook scripts are executed by the server whenever specific repository actions occur, such as a push operation.\nAn attacker can upload a malicious shell script into the hooks folder and ensure it is marked as executable. Once the hook is placed, the attacker triggers the execution by performing a routine git push or by forcing the hook to run through the diffpatch API's unintended side effects.\nSince the Gitea process runs the hooks as the system user owning the Gitea binary, the attacker achieves arbitrary code execution with the same permissions as the Gitea service. This bypasses typical application-layer security controls because the malicious behavior is executed by the system's Git implementation itself.\nPost-exploitation, the attacker can establish persistent command-and-control (C2) communication, modify source code within the repository to introduce supply chain vulnerabilities, or escalate privileges if the Gitea service account possesses excessive local system permissions.\nThe attack is highly effective because it abuses legitimate Git functionality to weaponize a development platform. Affected versions include all releases prior to 1.27.1. Exposure is primarily network-dependent; if the Gitea instance is exposed to the internet, any remote actor can trigger the flaw provided they can interact with the diffpatch API endpoint, regardless of the repository visibility settings, depending on the specific API implementation details."
}