Gitea Remote Code Execution via diffpatch Git Hook Injection

CVE-2026-60004 is a code-injection flaw in Gitea's POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, present in every release from 1.17 through 1.27.0 — roughly four years of releases. By sending a crafted patch that triggers an add/add collision in Git's three-way merge fallback, an attacker writes a malicious file into the Git hooks directory of a temporary bare clone. The next Git operation executes that hook as the Gitea service account, giving the attacker full OS-level command execution. Because Gitea's default configuration ships with open self-registration, no email confirmation, and no admin approval, an anonymous internet user can create an account, create a repository, and fire the exploit — no prior credentials required.

The CNA-assigned CVSS 9.8 is accurate and, if anything, undersells the operational impact. Gitea is not a random web app — it is the source-code management layer for every project it hosts. RCE on the Gitea server means access to every repository, every deploy key, every CI/CD webhook secret, and every stored credential. On default installations the attack is unauthenticated and trivially scriptable with a public PoC. The only friction is that the target must be reachable and running a vulnerable version. There is no reason to downgrade this.

Why this verdict

• Unauthenticated on default installs: Open registration is the default — the attacker self-provisions the write access the chain needs. This is functionally pre-auth RCE on unmodified deployments.
• Public weaponized PoC with zero user interaction: The advisory itself ships a working exploit. No callback infrastructure needed; output is exfiltrated via Git objects. Script-kiddie-grade barrier to entry.
• Role multiplier: Gitea is canonically an SCM/CI-adjacent component. 100% of installs serve this role by definition. RCE on Gitea = access to all hosted source code, secrets embedded in repos, deploy keys, CI/CD webhook tokens, and runner configurations. Blast radius is supply-chain-scale. This sets a CRITICAL floor that friction cannot override.
• Four-year affected window: Versions 1.17–1.27.0 span the vast majority of the installed base, including the most popular 1.23–1.26 release lines. The narrow unaffected population is pre-1.17 legacy only.
• Stealth-friendly release notes: The v1.27.1 release notes did not flag this as a security fix, meaning many operators may not have prioritized the upgrade — widening the real-world exposure window.

Why not higher?

This is already assessed at the maximum actionable severity (CRITICAL / 9.8). There is no higher bucket.

Why not lower?

Every downgrade factor was evaluated and rejected. The only friction is network reachability and registration policy — but default config is open, and ~6,200 instances are internet-facing per Shodan. Gitea is a canonical high-value SCM component where RCE yields supply-chain compromise by definition. The public PoC makes exploitation trivial. There is no credible basis for reducing below CRITICAL.

1. Disable public registration immediately — Set DISABLE_REGISTRATION = true in [service] of app.ini and restart Gitea. This removes the self-provisioning path for unauthenticated attackers. Does not protect against existing authenticated users with write access. Deploy within the noisgate mitigation SLA of ≤3 days.
2. Restrict or disable the diffpatch API endpoint — Use a reverse-proxy rule (nginx, Caddy, Traefik) to block POST requests matching /api/v1/repos/*/diffpatch. This surgically kills the vulnerable code path without disrupting normal Git operations. Deploy within 3 days per noisgate mitigation SLA.
3. Mount Gitea temp directories with noexec — If the Gitea process's temp filesystem is mounted noexec, planted hooks cannot execute even if written. Add noexec to the mount options for /tmp or the configured TEMP_PATH. Verify with mount | grep tmp. Deploy within 3 days.
4. Run Gitea in a hardened container with read-only root filesystem — Use --read-only and drop all unnecessary Linux capabilities. This limits post-exploitation lateral movement even if the hook fires. Not a substitute for patching but reduces blast radius.
5. Audit existing repository write permissions — Review all users with write or admin access to repositories. Remove stale accounts and enforce MFA. This reduces the insider-threat variant of the attack path.

Run this script on the Gitea server (or any host with SSH/API access to it) as any user who can read the Gitea binary or query its API. Example: bash check_cve_2026_60004.sh https://gitea.example.com — no special privileges required beyond reading the /api/v1/version endpoint.

#!/usr/bin/env bash
# check_cve_2026_60004.sh — Detect Gitea versions vulnerable to CVE-2026-60004
# Usage: bash check_cve_2026_60004.sh <GITEA_BASE_URL>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <GITEA_BASE_URL>"
  echo "Example: $0 https://gitea.example.com"
  exit 2
fi

BASE_URL="${1%/}"

# Fetch version from public API endpoint
VERSION_JSON=$(curl -sf --max-time 10 "${BASE_URL}/api/v1/version" 2>/dev/null) || {
  echo "UNKNOWN — could not reach ${BASE_URL}/api/v1/version"
  exit 2
}

VERSION=$(echo "$VERSION_JSON" | grep -oP '"version"\s*:\s*"\K[^"]+' 2>/dev/null) || {
  echo "UNKNOWN — could not parse version from API response"
  exit 2
}

echo "Detected Gitea version: ${VERSION}"

# Extract major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$(echo "$VERSION" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')"

if [[ -z "$MAJOR" || -z "$MINOR" || -z "$PATCH" ]]; then
  echo "UNKNOWN — could not parse semantic version from '${VERSION}'"
  exit 2
fi

# Vulnerable: 1.17.0 <= version < 1.27.1
if (( MAJOR == 1 )); then
  if (( MINOR < 17 )); then
    echo "PATCHED — version ${VERSION} predates the vulnerable code (introduced in 1.17)"
    exit 0
  elif (( MINOR > 27 )); then
    echo "PATCHED — version ${VERSION} is newer than the fixed release"
    exit 0
  elif (( MINOR == 27 && PATCH >= 1 )); then
    echo "PATCHED — version ${VERSION} includes the fix (1.27.1+)"
    exit 0
  else
    echo "VULNERABLE — version ${VERSION} is in the affected range (1.17.0–1.27.0)"
    exit 1
  fi
elif (( MAJOR > 1 )); then
  echo "PATCHED — major version ${MAJOR} is beyond affected range"
  exit 0
else
  echo "PATCHED — version ${VERSION} predates affected range"
  exit 0
fi

Sources

1. CyCognito Emerging Threat Analysis
2. The Hacker News — Gitea RCE Coverage
3. Sanjay Seth — CVE-2026-60004 Deep Dive
4. runZero — Gitea Vulnerability Asset Discovery
5. CyberSecurityNews — Gitea RCE Vulnerability
6. CyberArtsPro — Gitea Critical RCE Flaw
7. NightRang3r (Shai Rod) — GitHub Profile