Executive Summary
A critical vulnerability, tracked as CVE-2026-60004 with a CVSS score of 9.8, has been identified in the Gitea self-hosted Git platform. The flaw allows users with repository write permissions to execute arbitrary shell commands as the Gitea service account. While exploitation requires authentication, Gitea's default configuration allows open registration, effectively enabling unauthenticated attackers to create accounts and execute this attack on unchanged installations.
The technical root cause involves Gitea's handling of patches in shared bare temporary clones. By submitting a specific patch twice, an attacker can trigger a three-way fallback collision that writes an executable file to the Git hooks directory. This hook is subsequently executed by the Git process during index updates, bypassing intended security controls.
Impacted organizations include any entity running Gitea versions 1.17 through 1.27.0. Successful exploitation could lead to full compromise of the Gitea instance, including access to database credentials, application secrets, and hosted source code. Upgrading to version 1.27.1 is the primary recommended mitigation.