Attackers with repository write permissions can execute shell commands as the Gitea service account in versions 1.17–1.27.0 via Git Hooks; fix available in 1.27.1.