Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. services/repository/files/patch.go applies attacker-controlled patches in a shared bare temporary clone using 'git apply --index --recount --cached --binary', adding the '-3' three-way fallback when Git 2.32 or later is present. Submitting the same patch twice creates an add/add collision, and Git's three-way fallback checks the indexed path out even though the operation is performed with --cached. Because the clone is bare, the repository root is GIT_DIR, so an executable entry named hooks/post-index-change becomes a live Git hook which Git invokes while writing the index. An attacker with ordinary write access to a repository can therefore execute arbitrary shell commands as the Gitea OS user; with default open registration an unauthenticated visitor can obtain the required write access by registering an account and creating a repository. Affects Gitea 1.17 and later before 1.27.1.