New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
A critical remote code execution vulnerability in Gitea, a self-hosted Git platform, allows a user with ordinary repository write access to run shell commands as the Gitea service account. The flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1.
Intelligence analysis by Llama
A user with repository write access can exploit the vulnerability to run shell commands as the Gitea service account, potentially exposing sensitive information. The fix is to upgrade to Gitea version 1.27.1.
Imagine you have a special kind of computer program called a Git repository. This program helps you keep track of changes to your code. But, if someone with the right access can trick the program, they can run any command they want on the computer. This is like giving them a superpower. The good news is that the people who made the program, Gitea, have fixed the problem. They made a new version of the program, 1.27.1, that is safe. If you have Gitea, you should update it to the new version to keep your computer safe.
Analysis
A Critical Vulnerability in Gitea
Gitea, a self-hosted Git platform, has been found to have a critical remote code execution vulnerability. This vulnerability allows a user with ordinary repository write access to run shell commands as the Gitea service account. The flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1.
The vulnerability was discovered by security researcher Shai Rod, who goes by NightRang3r. Rod had previewed the RCE alongside a separate file-inclusion issue, with a PoC retrieving /etc/passwd from a Gitea 1.27.0 host. That issue appears to correspond to a separate change included in 1.27.1 that altered Gitea's Org-mode renderer so #+INCLUDE paths are returned as plain text instead of being read from the server's filesystem.
Gitea has not published a separate advisory or CVE for the file-inclusion issue. The fix for the RCE is to upgrade to Gitea version 1.27.1. Disabling open registration can remove the public account-creation path while the update is deployed, but it does not fix the flaw or protect against existing users with repository write access.
The Impact of the Vulnerability
The vulnerability has the potential to expose sensitive information, including application and environment secrets, mounted repositories, database credentials and contents, OAuth credentials, and reachable internal services. The attacker would need to have repository write access, Git 2.32 or later, an enabled diffpatch route, and a writable, executable temporary filesystem. Default registration lets an outsider obtain the required write access on an unchanged installation.
The Fix
The fix for the RCE is to upgrade to Gitea version 1.27.1. Gitea changed the temporary clone from bare to non-bare. The code comment explicitly warns that Git commands using --index may operate on the working tree. The change was merged and backported on July 26, 2026. Version 1.27.1 shipped on July 27, and the security advisory followed on July 28. The release notes listed the change under MISC as "refactor: git patch apply," not under SECURITY.
Key points
- A critical remote code execution vulnerability in Gitea allows a user with ordinary repository write access to run shell commands as the Gitea service account.
- The flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1.
- The vulnerability was discovered by security researcher Shai Rod, who goes by NightRang3r.
- The fix for the RCE is to upgrade to Gitea version 1.27.1.
- Disabling open registration can remove the public account-creation path while the update is deployed, but it does not fix the flaw or protect against existing users with repository write access.
The fix for the RCE is easy to implement, and Gitea has provided clear instructions on how to upgrade to version 1.27.1. This should help prevent further exploitation of the vulnerability. Additionally, Gitea's decision to automatically upgrade its Cloud instances will also help to mitigate the risk.
The fact that the vulnerability was not discovered until after the release of version 1.27.0 suggests that there may be other, similar vulnerabilities in Gitea that have not yet been identified. This could lead to further exploitation of the platform, potentially with more severe consequences.
