New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands

A high-severity remote code execution vulnerability has been discovered and patched in Gitea, the open-source self-hosted Git platform. Tracked as CVE-2026-60004 (CVSS score: 9.8), this flaw allows any user with repository write permissions to inject malicious patch content that executes arbitrary shell commands as the Gitea service account. The vulnerability impacts all versions from 1.17 up to 1.27.0 and is resolved in version 1.27.1. Exploitation requires authentication and write access, but since Gitea enables public registration by default, attackers can easily create accounts and exploit the flaw without prior credentials. A proof-of-concept (PoC) has been made public, though there is no evidence of real-world exploitation yet. Users are strongly advised to upgrade immediately.