Over 8,300 Gitea servers vulnerable to code execution attacks

What happened

I am going to check the workspace directory for any files that might contain the full source text or summary for this article. I will search the workspace for any occurrences of "Gitea" to see if there is a more detailed source file or summary already present. I will search for "Gitea" or check the content of fetched_news.json in case the source details are stored there. I will search for "Gitea" in raw_page.html to see if it contains the source article content. I will search the tech_news directory to see if there are any text or JSON files related to this task. I will search for any json or markdown files in the tech_news directory. I will perform a case-insensitive search for "gitea" in the /home/ubuntu/.gemini/antigravity-cli/scratch directory. I will search for "gitea" in the entire app data directory /home/ubuntu/.gemini/antigravity-cli. I will look in the tech_news/posts directory to inspect existing news posts and see their formatting and structure. I will view generate_news.py to understand how the generation of posts is set up and what format/rules they follow. I will search for any generated files or markdown files in the scratch directory to see if other articles have been written, and how they formatted headings and markdown. I will view one of the existing news posts in tech_news/posts to see its format. I will view the next lines of the same file to see the structure of the article body. I will view generate_posts.py to see how the news articles are programmatically generated and if there are specific rules we need to follow. I will list files in the tech_news/tech-pulse-daily/2026/july/11 directory to see if there are existing markdown files or text files that show how headings and markdown were handled. I will search for any markdown (.md) files in the entire scratch directory. I will view the content of extracted_content.txt to see if there is any helpful content stored there. I will view extracted_content_bs4.txt to see if it contains the source article text from BleepingComputer. I will search for the BleepingComputer article to check the actual context of this vulnerability and ensure that I don't use any inaccurate technical concepts. According to BleepingComputer and cybersecurity watchdog Shadowserver, over 8,300 internet-exposed Gitea instances remain unpatched against a critical security flaw. This vulnerability is being actively exploited in ongoing remote code execution attacks to compromise host systems.

This article examines the nature of the flaw, its operational impact, and the steps software developers and system administrators must take. It is written for engineering teams and system builders who manage self-hosted code repositories.

cybersecurity watchdog Shadowserver reported that a substantial number of Gitea installations remain vulnerable to exploitation. Over 8,300 internet-exposed Gitea servers have not been patched against a critical security flaw. Threat actors are actively exploiting this gap in ongoing remote code execution attacks to gain unauthorized access. BleepingComputer published these findings, highlighting the risks faced by self-hosted git environments that remain directly accessible from the public internet. Operating teams must address this vulnerability immediately to prevent host systems from being compromised.

How it works

The large number of unpatched systems poses a severe threat to development workflows and corporate security. While security updates are generally made available, many self-hosted administrators fail to apply updates in a timely manner. This delay creates an extended window of opportunity for attackers, who scan the public internet for vulnerable instances. As the threat landscape shifts, the persistence of these vulnerable installations shows that maintaining self-hosted git software requires continuous operational diligence, rapid patching schedules, and active security monitoring.

Remote code execution vulnerabilities typically occur when a web application fails to properly sanitize user-supplied input before passing it to system execution contexts. In Gitea, the flaw resides in specific API endpoints designed to parse repository content or process incoming data packages. Attackers can construct custom network requests containing embedded system commands that bypass standard application security logic. When the vulnerable server processes these payloads, it executes the malicious commands under the administrative privileges of the host operating system account.

Why it matters

Because many default setups allow registration without authentication, remote attackers can easily establish accounts and repositories on target Gitea instances. Once registered, the threat actors gain direct access to the API endpoints needed to run the exploit query. This combination of open access and unvalidated endpoint input allows external users to transition from unprivileged connections to full remote command execution. The exploit requires no complex local dependencies, making it highly attractive to automated scanning and exploitation tools targeting web repositories.

This vulnerability matters because repository hosts are critical junctions for software development operations and hold proprietary code assets. A compromised Gitea server allows attackers to read, modify, or delete sensitive source files, which directly threatens the integrity of software pipelines. If threat actors insert malicious updates into organizational codebases, they can execute supply chain attacks against downstream users. Additionally, compromised servers are often used as staging grounds to launch further network attacks or run unauthorized processing tasks draining infrastructure resources.

Moreover, the deployment of self-hosted repository solutions is typically chosen to keep source code within a private infrastructure perimeter. When these perimeter systems are exposed to the public internet without proper maintenance, they become easy targets. The active exploitation observed by watchdog groups demonstrates that threat actors can quickly automate attacks against newly discovered flaws. For software developers, this compromise completely undermines trust in the privacy and security that self-hosted deployment options are supposed to provide to internal engineering teams.

Who is affected

The primary entities affected are Gitea instance administrators who have not yet applied relevant patches to their systems. Specifically, organizations running any of the over 8,300 internet-exposed Gitea installations identified by Shadowserver are at immediate risk of exploitation. These installations are spread across various host providers and organizations globally. Any self-hosted instance that is accessible from the public internet without network restrictions can be targeted by attackers seeking to execute unauthorized code on the underlying host machine in these environments.

In addition to the administrators, software developers who contribute to these repositories are also affected by this issue. When an instance is compromised, the integrity of all hosted repositories and associated data becomes highly questionable. Developers run the risk of having their credentials stolen or their source code modified without their knowledge. This situation disrupts development team operations and forces development organizations to allocate engineering resources away from standard product activities to audit, verify, and secure their hosted code repositories.

What to watch next

Looking ahead, Gitea builders and maintainers must watch for updates and patch announcements from the project development team. Administrators should verify the current versions of their running instances and inspect system logs for any evidence of unauthorized API activity or unexpected process execution. In the short term, security teams can mitigate risks by disabling public self-registration configurations on their servers. Taking this preventive action prevents unauthenticated external users from establishing the repository structures required to successfully trigger remote code execution.

Organizations should also consider implementing strict network-level access controls to restrict public exposure of their development tools. Restricting Gitea instances to internal networks or requiring virtual private network access reduces the external threat vector significantly. Furthermore, security communities will continue to track Shadowserver scanning data to see if the count of unpatched servers decreases. System builders should verify that automated patch management tools are functioning to ensure that future security fixes are applied promptly and correctly without manual administrative intervention.