This critical remote code execution vulnerability in Gitea is actively exploited in the wild and requires immediate patching to prevent unauthorized system control.

The flaw exists within the diffpatch feature, allowing an attacker with repository write access to plant an executable Git hook and execute shell commands as the Gitea OS user. On default installations that allow open self-registration, this can be triggered by an unauthenticated attacker who creates a new account to gain the necessary repository write access.

The vulnerability carries a CVSS score of 9.5, indicating a critical risk to the confidentiality, integrity, and availability of the affected environment. Successful exploitation grants attackers the ability to execute arbitrary code, which has already been observed in the wild to deploy unauthorized cryptocurrency miners, leading to potential service disruption, resource theft, and further compromise of the host infrastructure.

Immediate Action: Upgrade all Gitea instances to version 1.27.1 or later immediately.

Proactive Monitoring: Monitor server logs and system resource usage for suspicious spikes or unauthorized process executions, particularly those associated with the Gitea service user account.

Compensating Controls: Disable self-registration on public-facing Gitea instances to prevent unauthenticated attackers from obtaining the repository write access required to trigger this exploit.

Public Exploit Available: Yes, multiple public proof-of-concept exploits are available on GitHub.

Given the confirmed active exploitation and the critical nature of this remote code execution flaw, organizations must prioritize patching Gitea instances to version 1.27.1 immediately. Failure to apply this update leaves systems highly vulnerable to full compromise by opportunistic threat actors.