Gitea patches critical RCE (CVE-2026-60004) allowing shell execution via Git hooks
This digest was compiled by AI from multiple sources — links to the originals are below.
Gitea patches a critical remote code execution vulnerability (CVE-2026-60004, CVSS 9.8) that lets authenticated users with repository write permissions execute arbitrary shell commands. The fix ships in version 1.27.1, released July 27, and Gitea Cloud instances have been automatically updated. A public proof-of-concept exists, though no active exploitation has been confirmed.
The Vulnerability
The flaw, tracked as CVE-2026-60004 with a CVSS score of 9.8, resides in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint. According to Gitea's advisory, the endpoint applies a user-supplied patch in a shared bare temporary clone. When git apply is invoked with --index and --cached flags, and Git version 2.32 or later is used, an attacker can submit the same patch twice to create an add/add collision. The three-way merge fallback then checks out the path into the bare repository's Git directory, allowing a malicious executable dropped at hooks/post-index-change to be activated. The vulnerability was reported by security researcher Shai Rod (NightRang3r).
The Fix
Gitea released version 1.27.1 on July 27 to address the vulnerability. All versions from 1.17 to pre-1.27.1 are affected. Gitea Cloud instances were upgraded automatically. The project recommends upgrading immediately. Disabling open registration can prevent anonymous users from creating accounts to exploit the bug, but does not fix the underlying flaw or protect against existing trusted users with write access. The default Gitea configuration enables open registration, which increases exposure.
Exploitation Status
The advisory does not report any exploitation in the wild. However, a public proof-of-concept exploit is included in the advisory. The PoC demonstrates that an attacker with a normal user account can create a repository, send the malicious patch twice, and retrieve command output through Git objects. As of July 29, no confirmed attacks have been reported.
What's Next
Gitea urges all self-hosted instances to upgrade to version 1.27.1 immediately. It remains unclear whether attackers have actively scanned for vulnerable instances or will leverage the public exploit before widespread patching occurs.
1 source
Gitea patches critical RCE (CVE-2026-60004) allowing shell execution via Git hooks
