🚨 CVE-2026-60004 - RCE

Critical Remote Code Execution in Gitea via diffpatch Git Hook

A critical Remote Code Execution (RCE) vulnerability allowing arbitrary command execution through the diffpatch API endpoint by abusing Git hook execution.

---

📖 Overview

CVE-2026-60004 is a Critical Remote Code Execution (RCE) vulnerability affecting Gitea. The flaw exists in the implementation of the diffpatch endpoint, where specially crafted patches can abuse Git's hook mechanism during patch application.

Successful exploitation allows an authenticated attacker with repository write permissions to execute arbitrary commands on the Gitea server with the privileges of the Gitea service.

🔥 Severity

🎯 Affected Products

• Gitea 1.17
• Gitea 1.18
• Gitea 1.19
• Gitea 1.20
• Gitea 1.21
• Gitea 1.22
• Gitea 1.23
• Gitea 1.24
• Gitea 1.25
• Gitea 1.26
• Gitea 1.27.0

✅ Fixed Version

Gitea 1.27.1

⚡ Vulnerability Summary

The vulnerability originates from the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint.

A malicious patch can introduce a Git hook into a temporary repository created during patch processing. When Git subsequently executes repository operations, the injected hook runs automatically, resulting in arbitrary command execution on the server.

🛠 Attack Requirements

An attacker typically requires:

• Authenticated account
• Ability to create or modify a repository
• Write permission to the repository

⚠️ Instances with public user registration enabled are at significantly higher risk.

💥 Potential Impact

Successful exploitation may allow attackers to:

• Execute arbitrary operating system commands
• Completely compromise the Gitea server
• Access private repositories
• Steal SSH keys
• Obtain CI/CD secrets
• Extract API tokens
• Access deployment credentials
• Move laterally across internal infrastructure

🔍 Exploitation Flow

Attacker
    │
    ▼
Craft malicious diff patch
    │
    ▼
POST /api/v1/repos/.../diffpatch
    │
    ▼
Git applies patch
    │
    ▼
Malicious Git Hook installed
    │
    ▼
Git executes hook
    │
    ▼
Arbitrary Command Execution

📌 Attack Surface

Internet
      │
      ▼
Authenticated User
      │
      ▼
diffpatch API
      │
      ▼
Temporary Git Repository
      │
      ▼
Git Hook Execution
      │
      ▼
Remote Code Execution

🛡 Mitigation

Immediately:

• Upgrade to Gitea 1.27.1 or newer.
• Disable public registration if unnecessary.
• Restrict repository creation.
• Limit repository write permissions.
• Monitor unusual diffpatch requests.
• Audit Git repositories for unauthorized hooks.
• Rotate exposed credentials if compromise is suspected.

🔎 Indicators of Compromise

Investigators should look for:

• Unexpected Git hook files
• Suspicious child processes spawned by Gitea
• Unknown shell executions
• Unusual API calls to /diffpatch
• Unauthorized repository modifications
• Unexpected outbound network connections

📊 Risk Assessment

📚 Technical Details

🚨 Security Recommendations

✔ Upgrade immediately.

✔ Monitor API logs.

✔ Restrict repository permissions.

✔ Disable unused registration features.

✔ Rotate secrets if compromise is suspected.

✔ Continuously monitor Git hook integrity.

📜 Disclaimer

This repository is intended solely for educational, defensive, and research purposes.

The information provided here aims to help security professionals understand, detect, and mitigate the vulnerability. Do not use this information against systems without explicit authorization.