A Critical Flaw in Gitea Leaves DevOps Platforms Vulnerable to Code Injection Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about an actively exploited critical-severity vulnerability in Gitea, a self-hosted Git service used by developers worldwide. Attackers are exploiting this flaw to inject malicious code into vulnerable servers, potentially allowing them to execute arbitrary shell commands with elevated privileges.
Gitea is designed as a self-hosted alternative to cloud-based platforms like GitHub and GitLab, offering a full suite of DevOps tools for software development teams. However, its default configuration allows unauthenticated users to register an account and create new repositories, providing a pathway for attackers to exploit the vulnerability without prior credentials.
The flaw, tracked as CVE-2026-60004, resides in Gitea’s diffpatch API endpoint, which can be abused by an authenticated user with repository write access to execute arbitrary shell commands. According to Gitea’s security team, this is possible because “an attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user.” The vulnerability has been patched in version 1.27.1 of Gitea, released on July 27.
CISA has added CVE-2026-60004 to its KEV catalog and ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three days, as mandated by Binding Operational Directive (BOD) 26-04. While the exact number of affected Gitea instances is unknown, cybersecurity watchdog Shadowserver reports nearly 5,000 exposed online.
This vulnerability is a stark reminder that even seemingly secure platforms can harbor critical flaws waiting to be exploited. The CISA’s warning serves as a wake-up call for all organizations using Gitea or similar services to prioritize remediation of known vulnerabilities and adopt robust risk-based vulnerability management practices.
While this specific flaw has been patched, it highlights the importance of regular software updates and vigilant monitoring of security advisories. As threat actors continue to evolve their tactics, staying ahead of emerging threats requires a proactive approach to cybersecurity. To minimize the risk of code injection attacks like this one, we recommend that developers and administrators take the following steps:
* Regularly update Gitea to the latest version (at least 1.27.1)
* Review default configuration settings to ensure self-registration is disabled
* Monitor server logs for suspicious activity and implement robust monitoring tools
* Prioritize risk-based vulnerability management practices and remediate known vulnerabilities promptly
By taking these precautions, developers can help protect their DevOps platforms from the ever-present threat of code injection attacks.
Source: Bleeping Computer — 2026-08-26