Gitea Patches Critical RCE, Upgrade to 1.27.1

Gitea shipped version 1.27.1 today to close a critical remote code execution flaw affecting every release from 1.17 onward.

The vulnerability is in how Gitea processes patch content. An attacker with ordinary repository write access — the kind of access most developers have on a shared instance — can craft a patch that plants a malicious git hook in the repository. When that hook fires, it executes attacker-controlled shell commands as the Gitea service account. No admin privileges. No extra authentication steps. Write access is enough.

That changes the threat model for shared self-hosted instances. If your Gitea server has external contributors, contractors, or any lower-trust accounts with write access, those accounts can now pivot to whatever the Gitea process runs as. Depending on service account configuration — and many default installs are more permissive than they should be — that means arbitrary code execution on the host, access to every repository the service account can reach, and any credentials the process holds in memory or config.

What to do

Upgrade to Gitea 1.27.1. Full stop. The release is available from Gitea’s official site and via Docker Hub for containerized installs. Identify your current version, confirm your upgrade path, and run it.

If you cannot upgrade immediately:

• Audit repository write permissions. If any external-facing or lower-trust accounts have write access to repositories on the instance, restrict them until you can patch.
• Review recent patch submission and hook activity on repositories accessible to those accounts.
• Check how the Gitea service account is configured. If it runs with elevated filesystem access, the blast radius is wider. A dedicated low-privilege user account is the correct baseline — verify that yours is there.

The service account’s privilege level is the main variable here. A hardened deployment running Gitea under a minimal-permission user with strict process isolation contains the damage. An install running as root or a broadly-privileged account does not.

Priority call

Self-hosted developer infrastructure does not get the same patch cadence attention as production edge systems, and attackers know it. This one warrants the same urgency as the JetBrains TeamCity RCE patched this week — both affect the infrastructure that builds and manages your code. Upgrade Gitea first, then audit.

Sources: The Hacker News.