A security flaw has been found in Gitea, a tool used to host and manage code repositories. This vulnerability allows an attacker who already has permission to make changes to your Gitea repository to send a specially crafted file patch to Gitea's diffpatch API feature. When this patch is processed, it installs a hidden, malicious Git hook that lets the attacker run shell commands on the server using the same account that powers the Gitea service.
If your Gitea instance is hosted on the same server as your websites or other hosted content, this flaw could let an unauthorized person access, modify, or delete files on that server, or disrupt your hosted services. This risk only applies to users who run Gitea for code management, and only if an untrusted third party has write access to your Gitea repositories.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-60004
