CVE-2026-60004: 
Gitea vulnerability analysis and mitigation

CVE-2026-60004 is a critical remote code execution (RCE) vulnerability in Gitea affecting versions 1.17 through 1.27.0 (before 1.27.1). The flaw allows an attacker with repository write access to execute arbitrary shell commands as the Gitea OS service account by abusing the diffpatch API endpoint to install a malicious Git hook. With open user registration enabled (a common default), an unauthenticated visitor can register an account, create a repository, and exploit the vulnerability without any prior credentials. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, CISA KEV).

The root cause (CWE-94: Improper Control of Generation of Code) lies in services/repository/files/patch.go, which applies attacker-controlled patches in a shared bare temporary clone using git apply --index --recount --cached --binary -3. When the same patch is submitted twice, an add/add conflict is created; Git's three-way fallback checks out the indexed path even though the operation is --cached. Because the working directory in a bare clone is $GIT_DIR, an executable entry named hooks/post-index-change becomes a live Git hook. Git then invokes this hook while writing the index, executing arbitrary commands as the Gitea service account. The attack requires Git 2.32 or newer on the server (for the -3 three-way fallback), an enabled diffpatch route, and a writable/executable temporary filesystem. The hook's return value is not propagated to the diffpatch API response, so exploitation is largely silent; output can be exfiltrated by storing results in Git objects and fetching them via authenticated smart HTTP (GitHub Advisory).

Successful exploitation grants arbitrary OS command execution as the Gitea service account, resulting in full confidentiality, integrity, and availability compromise of the affected server. An attacker can access app.ini and application secrets, process environment variables, mounted repositories, database credentials and contents, OAuth and CI/CD integration tokens, and SSH keys. Depending on deployment isolation, this can enable lateral movement to internal services, databases, and connected infrastructure. Real-world victims have reported CPU spikes consistent with cryptominer payload deployment (CISA KEV, GitHub Advisory, BugsToday).

CVE-2026-60004 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-08-25 with a due date of 2026-08-28 (CISA KEV). At least nine public proof-of-concept exploit scripts are available on GitHub (Python and Go), several of which support fully automated, unauthenticated exploitation chains including user registration, repository creation, malicious patch submission, and reverse shell or output exfiltration (EQSTLab PoC, imbas007 PoC). Exploitation has been confirmed in the wild with reports of cryptominer-like payloads being dropped on compromised servers. A Metasploit module pull request has also been submitted (Rapid7 PR). The EPSS score is currently 0.0 (likely not yet updated to reflect active exploitation). NVD SSVC classifies exploitation as "active" and the attack as "automatable" with "total" technical impact.

1. Reconnaissance: Identify internet-facing Gitea instances running versions 1.17–1.27.0 using Shodan, Censys, or FOFA, targeting the /api/v1/version endpoint to confirm the version. Check whether open registration is enabled by visiting the /user/sign_up page.
2. Account Registration (if open registration is enabled): Register a new account via the Gitea web UI or API (POST /api/v1/user/sign_up) to obtain repository write access without prior credentials.
3. Repository Creation: Create a new private repository with SHA-1 object format and auto-initialization via POST /api/v1/user/repos with {"auto_init": true, "object_format_name": "sha1"}.
4. Craft Malicious Patch: Build a unified diff patch that introduces an executable file at hooks/post-index-change containing a shell script that executes the desired command and stores output in a Git object, then creates a branch with the result for exfiltration.
5. First Patch Submission: Submit the malicious patch to POST /api/v1/repos/{owner}/{repo}/diffpatch with the patch content in the content field. This stages the hook file in the index of the temporary bare clone.
6. Second Patch Submission (Trigger): Submit the identical patch a second time to the same endpoint. This creates an add/add conflict, causing Git's three-way fallback to check out the hooks/post-index-change file into $GIT_DIR/hooks/, making it a live executable Git hook.
7. Hook Execution: Git automatically invokes the post-index-change hook while writing the index, executing the attacker's shell command as the Gitea service account.
8. Output Retrieval: Fetch the result branch via authenticated smart HTTP (git fetch against the repository) and read the output blob from the commit to retrieve command stdout/stderr and exit status — no outbound connection required (GitHub Advisory, EQSTLab PoC).

• Network: Repeated or automated POST requests to /api/v1/repos/{owner}/{repo}/diffpatch from the same IP or user account in rapid succession; unusual git fetch or smart HTTP clone requests to newly created repositories immediately after diffpatch calls; unexpected outbound connections from the Gitea process to attacker-controlled IPs (for reverse-shell variants).
• Logs: Gitea access logs showing two identical POST /api/v1/repos/.../diffpatch requests within seconds from the same session; API calls for account registration, repository creation, and diffpatch in a short automated sequence; GET /api/v1/version probes preceding exploitation activity.
• File System: Unexpected executable files at $GITEA_TEMP/*/hooks/post-index-change or similar paths within Gitea's temporary clone directories; new Git objects or branches named output-* in repositories; cryptominer binaries or dropper scripts written to disk by the Gitea service account.
• Process: Unusual child processes spawned by the Gitea process (e.g., /bin/sh, curl, wget, python3, mining binaries); elevated CPU usage on the Gitea host consistent with cryptominer activity.
• Repository: Newly created repositories with randomized names (e.g., test-repo-<hex>) that contain branches named output-<hex> with a single commit authored by poc <poc@example.invalid> (GitHub Advisory, 0xBlackash PoC).

The primary remediation is to upgrade Gitea to version 1.27.1 or later, which patches the vulnerable diffpatch logic (Gitea Blog). If immediate patching is not possible, apply the following interim mitigations: (1) Disable open user registration to prevent unauthenticated exploitation paths; (2) Restrict repository creation and write permissions to trusted users only; (3) Block or rate-limit access to the /api/v1/repos/.../diffpatch endpoint at the network or reverse-proxy layer; (4) Audit existing Git hook files in Gitea's temporary directories for unauthorized executables. CISA's BOD 26-04 requires federal agencies to apply mitigations by 2026-08-28 or discontinue use of the product (CISA KEV). Rotate all secrets (app.ini credentials, SSH keys, OAuth tokens, CI/CD secrets) if compromise is suspected.

CISA added CVE-2026-60004 to its KEV catalog on 2026-08-25 and issued an alert, citing active exploitation (CISA Alert). BleepingComputer, The Hacker News, SecurityWeek, and Help Net Security all published coverage highlighting the active exploitation and cryptominer payload delivery (The Hacker News, SecurityWeek). Security researchers on Mastodon and Reddit noted the irony that Gitea ships with open registration by default, effectively making the 9.8 CVSS score a pre-auth RCE in most deployments. A blog post titled "Gitea shipped a 9.8 that needs an account — Gitea also ships with anyone being able to make one" captured community sentiment. SOC Prime published detection content, and runZero published an asset identification guide for exposed instances (runZero Blog). A Metasploit module PR was submitted shortly after public disclosure, and Nuclei templates were added in v10.4.7.