A security vulnerability has been identified in Gitea, the open-source code repository management tool used by some of our hosting clients to store and manage project code. This is a code injection flaw that impacts Gitea instances.
To exploit the flaw, an attacker who already has write access to a Gitea repository can send a specially crafted malicious patch to Gitea’s diffpatch API endpoint. If successful, the attacker can install a hidden, executable automated script (called a Git hook) on the system. This script allows the attacker to run shell commands on the server using the permissions of Gitea’s service account.
If you run a Gitea instance on your hosting plan, this could let a malicious or compromised user with write access to your Gitea repositories gain unauthorized access to your hosting files, data, or other resources tied to your Gitea setup.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-60004
