CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

CVE-2026-60004 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-08-26

Gitea is a popular Git service that allows developers to host and manage code repositories. The diffpatch feature enables users to apply patches to repositories via an API endpoint. A flaw in patch handling allows attackers to install malicious Git hooks (executable scripts) that execute when Git reads the repository index. An attacker with repository write access—or any unauthenticated user on instances with open registration—can execute arbitrary system commands with the privileges of the Gitea service account, potentially exposing application secrets, database credentials, OAuth tokens, and other sensitive data.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-60004 exploited in the wild?
Yes. CVE-2026-60004 is known to be exploited in the wild, first recorded on 25 August 2026. Treat it as urgent.
How severe is CVE-2026-60004?
Critical severity, with a CVSS score of 9.8, published 26 August 2026.
Which products and versions are affected?
Gitea 1.17.0 to 1.27.0; code.gitea.io/gitea (Go) SEMVER:introduced=1.17.0; gitea.dev (Go) >= 1.17.0, < 1.27.1, SEMVER:introduced=0,fixed=1.27.1, SEMVER:introduced=1.17.0,fixed=1.27.1.
Is there a fix for CVE-2026-60004?
Yes. gitea.dev (Go): upgrade to 1.27.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-60004 attacked?
It is attacked over the network.
Am I affected by CVE-2026-60004?
Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gitea.dev (Go): upgrade to 1.27.1 or later
    go get gitea.dev@v1.27.1

Technical details

The vulnerability exists in services/repository/files/patch.go, which applies user-supplied patches to a shared bare temporary Git repository. By submitting the same patch twice, an attacker can create an add/add collision that causes Git's three-way merge fallback to check out files to the repository root ($GIT_DIR). In a bare repository, this allows placement of an executable file named hooks/post-index-change, which Git automatically invokes as a hook when writing the index. Git executes this hook with the privileges of the Gitea service account. The hook output is not returned in the API response, but a proof-of-concept demonstrates exfiltration via Git objects and branch creation. Exploitation requires Git 2.32 or newer, an enabled diffpatch route, and a writable/executable temporary filesystem. With open registration, no prior authentication is needed.

Affected products

  • go-gitea Gitea 1.17.0 to 1.27.0

Identifiers

  • CVE-2026-60004
  • GHSA-rcr6-4jqh-j84m
  • GO-2026-6433

Timeline

  • 2026-07-28: disclosed
  • 2026-09-08: advisory: Published as GHSA-rcr6-4jqh-j84m
  • 2026-09-08: patched: Fixed in Gitea 1.27.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.