CVE-2026-60004: Gitea RCE Vulnerability via Git Hooks

CVE-2026-60004 Overview

CVE-2026-60004 is a remote code execution vulnerability in Gitea before version 1.27.1. Attackers exploit the diffpatch API to install malicious Git hooks, which execute arbitrary commands on the host running Gitea. The flaw is classified under CWE-94: Improper Control of Generation of Code. CISA has added CVE-2026-60004 to the Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild.

Critical Impact
Unauthenticated attackers can achieve remote code execution on Gitea servers, leading to full compromise of source code repositories, CI/CD pipelines, and connected build infrastructure.

Affected Products

Gitea versions prior to 1.27.1
Self-hosted Gitea instances exposing the diffpatch API endpoint
Deployments permitting Git hook installation through the API

Discovery Timeline

2026-08-26 - CVE-2026-60004 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-60004

Vulnerability Analysis

The vulnerability resides in the Gitea diffpatch API, which processes patch operations against repositories. The API path fails to properly restrict server-side Git hook installation. Attackers submit crafted requests that write executable content into the .git/hooks/ directory of a target repository. Once Git performs any hook-triggering operation such as post-receive or pre-receive, the injected script executes under the Gitea service account.

Because Git hooks run arbitrary shell commands by design, this primitive yields immediate command execution on the host. The attack requires no user interaction and no prior authentication in vulnerable configurations, resulting in full compromise of the Gitea instance and any secrets, tokens, or repositories it stores.

Root Cause

The root cause is improper access control on the diffpatch API surface, combined with missing input validation that permits patch operations to modify server-side hook files. The API treats hook paths as ordinary repository content rather than privileged control files.

Attack Vector

Exploitation occurs over the network by issuing HTTP requests to the exposed Gitea API. The attacker submits a patch payload targeting the hook directory, then triggers a Git operation to execute the planted hook. Public proof-of-concept material is available in the GitHub PoC Repository for CVE-2026-60004.

// No verified exploit code is reproduced here.
// See the published PoC and the GHSA-rcr6-4jqh-j84m advisory for technical detail.

Detection Methods for CVE-2026-60004

Indicators of Compromise

Unexpected files written to .git/hooks/ directories within Gitea repositories, especially post-receive, pre-receive, or update scripts with recent modification timestamps.
HTTP requests to diffpatch API endpoints containing path references to hooks/ or shell interpreters such as #!/bin/sh.
Child processes spawned by the Gitea service account executing shell utilities, curl, wget, or reverse shell payloads.

Detection Strategies

Monitor Gitea access logs for anomalous diffpatch API calls, particularly from unauthenticated sessions or unexpected source addresses.
Alert on any process execution where the Gitea binary spawns /bin/sh, bash, or scripting interpreters outside normal Git operations.
Compare hook file hashes against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

Enable audit logging on the Gitea server and forward events to a centralized SIEM for correlation.
Track outbound network connections from Gitea hosts to detect command-and-control callbacks initiated by injected hooks.
Review the CISA Known Exploited Vulnerabilities Catalog entry for current exploitation reporting.

How to Mitigate CVE-2026-60004

Immediate Actions Required

Upgrade all Gitea instances to version 1.27.1 or later as documented in the Gitea Release Notes 1.27.1.
Restrict network exposure of Gitea administrative and API endpoints to trusted internal networks or VPN users only.
Rotate all credentials, deploy keys, webhooks, and API tokens stored in Gitea if compromise is suspected.

Patch Information

Gitea released version 1.27.1 to remediate this vulnerability. Review the GitHub Security Advisory GHSA-rcr6-4jqh-j84m for authoritative fix guidance and version metadata.

Workarounds

Disable or block access to the diffpatch API at the reverse proxy layer until the upgrade can be applied.
Enforce authentication on all API endpoints and require multi-factor authentication for repository administrators.
Run Gitea under a dedicated, low-privileged system account with restricted filesystem write permissions.

bash

# Nginx example: block the diffpatch API at the reverse proxy until patched
location ~* /api/v1/.*/diffpatch {
    deny all;
    return 403;
}