Gitea Servers Remain Exposed to Critical Vulnerability

A critical vulnerability in Gitea's diffpatch endpoint has been exploited by attackers, and over 8,300 servers are still exposed to the flaw. The bug, which was added to CISA's Known Exploited Vulnerabilities catalog on August 25, allows an attacker with ordinary write access to a repository to run shell commands as the Gitea OS user.

The issue works by applying a crafted patch inside a shared bare temporary clone, submitting the same patch twice creates an add/add collision, and Git's three-way fallback can check the indexed path out even though the operation is meant to be cached. This results in remote command execution, allowing attackers to access sensitive data and secrets.

The affected range of Gitea versions is broad, from 1.17 up to but not including 1.27.1, with a CVSS 3.1 score of 9.8, indicating a critical severity rating.

Shadowserver found over 8,393 exposed instances still vulnerable on August 27, and attackers are already exploiting the bug for malicious purposes, such as running crypto-mining payloads. The fix is to upgrade to Gitea version 1.27.1 or later, turn off self-registration unless necessary, and review whether the instance was exposed before the patch landed.