Gitea git service account reading app.ini or sensitive config/data files

Ethan Andrews@eandrews

•updated Jul 29, 2026•2•0•9

Detects unauthorized file system access to sensitive Gitea configuration files (app.ini) or internal directories (custom/conf, data/tmp) by the gitea/git service account. This pattern is indicative of post-exploitation credential or secret harvesting following remote code execution vulnerabilities, such as the diffpatch git hook RCE (CVE-2026-60004).