Critical Gitea RCE (CVE‑2026‑60004) Fixed in 1.27.1 – Write‑Access Hook Injection
A remote code execution flaw (CVE‑2026‑60004, CVSS 9.8) let any user with write permission inject a malicious Git hook that runs arbitrary shell commands as the Gitea service account. It affected Gitea 1.17+ up to 1.27.0. The issue is patched in the 1.27.1 release.