gitea.dev — Gitea: Remote Code Execution via diffpatch Git Hook Installation

Repositories where attackers have ordinary write access are exposed to arbitrary shell command execution as the Gitea OS user.

Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open…