A security flaw has been identified in Gitea, a popular tool for hosting and managing code repositories that many of our clients use for development and website-related projects. This is a code injection vulnerability, which allows unauthorized code to be run on the platform without proper permission.
To exploit this flaw, an attacker needs to already have write access to your Gitea repository. They can send a specially crafted, malicious file change (called a patch) to a specific Gitea feature called the diffpatch API. If this patch is processed, the attacker can plant a hidden, executable automated trigger (known as a Git hook) in your repository.
This hidden trigger lets the attacker run shell commands on the server using the permissions of the Gitea service account. This could let them access, modify, or delete data associated with your Gitea instance, or disrupt the normal operation of your Gitea service.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-60004
