{"id":2077,"date":"2026-07-29T10:05:10","date_gmt":"2026-07-29T10:05:10","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2077"},"modified":"2026-07-29T10:05:10","modified_gmt":"2026-07-29T10:05:10","slug":"new-gitea-rce-lets-repository-writers-plant-a-git-hook-to-run-shell-commands","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2077","title":{"rendered":"New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Jul 29, 2026<\/span><\/span>Vulnerability \/ DevOps<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account.<\/p>\n

Tracked as CVE-2026-60004<\/b><\/code> (CVSS score: 9.8), the flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1. The vulnerable API call requires authentication and repository write permission. But Gitea enables registration by default, so an outside visitor can create a normal account and repository on an unchanged installation, then exploit the bug without pre-existing credentials.<\/p>\n

Upgrading to 1.27.1 is the fix. Gitea said on July 27 that Gitea Cloud instances would be upgraded automatically. Gitea’s July 28 advisory does not say the flaw has been exploited in the wild, but it includes public proof-of-concept (PoC) code.<\/p>\n

Disabling open registration can remove the public account-creation path while the update is deployed, but it does not fix the flaw or protect against existing users with repository write access.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The flaw was reported by security researcher Shai Rod, who goes by NightRang3r<\/a>. Gitea credits NightRang3r as the reporter in its advisory.<\/p>\n

<\/p>\n

Gitea’s affected route<\/a> invokes reqToken()<\/code>, which rejects requests without a signed-in user. The no-prior-credentials path comes from the project’s default configuration<\/a>, which leaves registration open, requires neither email nor manual approval, does not mark new users as restricted, and imposes no default repository-creation limit.<\/p>\n

The bug sits in the POST \/api\/v1\/repos\/{owner}\/{repo}\/diffpatch<\/code> endpoint. According to Gitea’s security advisory<\/a>, the endpoint applies a supplied patch inside a shared bare temporary clone. Vulnerable builds invoke git apply<\/code> with --index<\/code>, --recount<\/code>, --cached<\/code>, and --binary<\/code>, adding the -3<\/code> three-way fallback option when the server runs Git 2.32 or later.<\/p>\n

An attacker submits the same patch twice to create an add\/add collision. The three-way fallback then checks the indexed path out even though the operation uses --cached<\/code>. Because the temporary clone is bare, its root is $GIT_DIR<\/code>. An executable file placed at hooks\/post-index-change<\/code> therefore lands in Git’s hook directory and becomes active. Git runs it while updating the index.<\/p>\n

\"\"<\/a><\/div>\n

The PoC signs in with a normal account, creates an initialized private repository, sends the malicious patch twice, and retrieves the command output. It needs no outbound callback. The hook stores the output in Git objects, creates a branch containing the result, and lets the attacker fetch it over authenticated smart HTTP.<\/p>\n

As of July 29, 2026, none of the cited primary sources reports whether the flaw was exploited before or after version 1.27.1 became available.<\/p>\n

Successful exploitation gives the attacker the privileges of the Gitea operating-system account. Depending on how the instance is isolated, Gitea said that could expose application and environment secrets, mounted repositories, database credentials and contents, OAuth credentials, and reachable internal services.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Exploitation still requires repository write access, Git 2.32 or later, an enabled diffpatch<\/code> route, and a writable, executable temporary filesystem. Default registration lets an outsider obtain the required write access on an unchanged installation.<\/p>\n

The fix is easy to miss in the changelog. Gitea changed the temporary clone from bare to non-bare. The code comment<\/a> explicitly warns that Git commands using --index<\/code> may operate on the working tree. The change was merged and backported on July 26, 2026.<\/p>\n

Version 1.27.1 shipped<\/a> on July 27, and the security advisory followed on July 28. The release notes listed the change under MISC as \u00abrefactor: git patch apply,\u00bb not under SECURITY.<\/p>\n

Rod had previewed the RCE alongside a separate file-inclusion issue<\/a>, with a PoC retrieving \/etc\/passwd<\/code> from a Gitea 1.27.0 host. That issue appears to correspond to a separate change included in 1.27.1<\/a> that altered Gitea’s Org-mode renderer so #+INCLUDE<\/code> paths are returned as plain text instead of being read from the server’s filesystem. Gitea has not published a separate advisory or CVE for the file-inclusion issue.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Swati Khandelwal\ue802Jul 29, 2026Vulnerability \/ DevOps Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch…<\/p>\n","protected":false},"author":1,"featured_media":2078,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[195,1462,1808,2780,332,2051,316,1425,1774,303,2779],"class_list":["post-2077","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-commands","tag-git","tag-gitea","tag-hook","tag-lets","tag-plant","tag-rce","tag-repository","tag-run","tag-shell","tag-writers"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2077","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2077"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2077\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2078"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2077"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2077"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2077"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}