If you can reg­is­ter, do this, cre­ate a repo and go to set­tings -> githooks and there add a com­mand as post-receive hook like a reverse shell. See https://www.cvedetails.com/vulnerability-list/vendor_id-19185/product_id-49829/Gitea-Gitea.html