1 article with this tag
Code injection (CWE-94, CVSS 9.8, KEV) in the diffpatch endpoint of Gitea 1.17 through 1.27.0. It ends with a malicious Git hook that runs commands as the Gitea OS user; the vendor lists application secrets, database credentials, OAuth tokens and mounted repositories as reachable from there. Updating to 1.27.1 is the fix — but the real lesson is the privilege condition: 'write access required' is satisfied by anyone the moment open registration is on.