The vulnerability affects all versions of Gitea prior to the latest patched release. Successful exploitation depends on the attacker having access to a repository where they can create or modify git hooks, and the service must be running with a user account that has sufficient filesystem permissions. Once exploited, the attacker can execute arbitrary commands on the underlying server, potentially leading to full compromise of the hosting instance and any data stored within it.

CISA has added this flaw to its Known Exploited Vulnerabilities catalog, signaling that active exploitation is occurring in the wild. The agency strongly recommends that administrators review their Gitea deployments and apply the available security update immediately. If immediate patching is not feasible, mitigations include restricting access to repository creation and hook management, as well as running the service with the least-privileged user account possible.

• Affected: Gitea versions before the latest security release
• Action: Update to the newest version immediately
• Additional mitigation: Disable or restrict git hook usage for untrusted users
• Monitor: Check server logs for unusual repository hook activity

Source: BleepingComputer

Is your team already tracking Gitea instances, and how are you handling the rollout of this patch across your self-hosted environments?