Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...
Found by web discovery while looking for coverage of CVE-2026-60004
CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.
CVE-2026-60004 is a CWE-94 code injection flaw in Gitea's POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, disclosed July 28, 2026 with a CVSS v3.1 score of 9.8 and credited to researcher Shai Rod (NightRang3r). An add/add collision with the three-way merge fallback (--3, Git 2.32+) writes attacker-controlled content into the temporary bare clone's hooks directory, where it executes as a live Git hook running commands as the Gitea OS user. Exploitation requires repository write access, but Gitea's default open registration allows anonymous users to obtain it, exposing app.ini secrets, database credentials, OAuth tokens, and mounted repositories; a public PoC requires no outbound callback. All releases from 1.17 through 1.27.0 are affected; the fix shipped in Gitea 1.27.1 on July 27, 2026, and Gitea Cloud instances were upgraded automatically.
- CVSS 9.8 (CWE-94) code injection in the diffpatch API endpoint; researcher Shai Rod (NightRang3r) reported it.
- Add/add collision with three-way merge writes attacker file into the bare clone's hooks directory, executed as a live Git hook.
- Exploitation needs repository write access, but default open registration makes anonymous exploitation possible on stock installs.
- Successful attacks can expose app.ini secrets, database credentials, OAuth tokens, and mounted repositories; PoC published.
- Affects Gitea 1.17 through 1.27.0; fixed in 1.27.1 (July 27, 2026) by switching temporary clones from bare to non-bare.
- CVEs
- CVE-2026-60004
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection | 9.8 | 24% | KEVPoC ×5 | KEV |
From the original article
5 min read at cycognito.comCVE-2026-60004 is a code injection vulnerability in Gitea, the self-hosted Git service, that allows attacker-controlled patch content to be installed and executed as a Git hook on the server. The vulnerability carries a CVSS v3. 1 base score of 9.
By Igal Zeifman · cycognito.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.