Executive brief
Gitea is a lightweight self-hosted Git service used by many organizations to manage source code repositories. An attacker with write access to a repository can exploit a flaw in the patch-diffing API to inject and execute malicious shell commands with the privileges of the Gitea service account. This could lead to complete compromise of the Gitea server, theft of source code, and lateral movement into connected systems. This vulnerability is already being actively exploited by attackers.
Technical details
The vulnerability is a code injection flaw in Gitea's diffpatch API endpoint that fails to properly sanitize patch data before passing it to Git operations. An attacker with repository write permissions can craft a malicious patch file containing shell metacharacters or Git hook injection sequences that execute arbitrary commands when processed by the diffpatch handler. The attack requires repository write access but does not require authentication beyond that level; once triggered, the injected commands execute with the privileges of the Gitea service account, potentially allowing full system compromise. Git hooks such as post-receive or update hooks can be planted in the repository's .git/hooks directory through the patch mechanism. The vulnerability has been observed in active exploitation campaigns in the wild. Patch availability and affected version information should be verified against the official Gitea advisory.
Affected products
- Gitea Gitea
Timeline
- 2026-08-25: disclosed
- exploited: Actively exploited in the wild