2026年7月29日 3:47 ET 发布 · 更新于 4 个月前 · 1 个来源
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
The Hacker News
·
原始报道
Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account. Tracked as CVE-2026-60004 (CVSS score: 9.8), the flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1. The
原文