Gitea versions prior to 1.27.1 contain a CWE‑94 flaw that permits remote code execution through the diffpatch API when a malicious Git hook is installed. The vulnerability can be leveraged by sending specially crafted diffpatch requests that cause the server to execute arbitrary shell commands with the privileges of the Gitea process. It enables full compromise of the host system, leading to data theft, modification, or service disruption.

All installations of Gitea running a build older than version 1.27.1 are affected. The issue is present in the standard Gitea product distributed by the vendor under the Gitea brand; any instance that exposes the diffpatch API to network clients is at risk.

The CVSS score of 9.8 classifies this flaw as critical, and Gitea's inclusion in the CISA KEV catalog indicates that it has been actively exploited. Since no EPSS score is provided, the high severity and KEV status suggest a high likelihood of exploitation in exposed environments. Based on the description, it is inferred that the attack vector requires network access to the diffpatch API endpoint and the ability to submit a crafted diffpatch request; once this is achieved, the attacker can execute arbitrary shell commands with the privileges of the Gitea process.