Gitea Remote Code Execution via diffpatch Git Hook Installation (CVE-2026-60004)

Gitea Remote Code Execution via diffpatch Git Hook (TL-2026-1767), also tracked as Gitea diffpatch Git Hook RCE, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-29 and last reviewed 2026-08-29. It has no confirmed attribution, affects Gitea Gitea, references 2 CVEs (CVE-2026-60004, CVE-2026-59774), maps to 29 MITRE ATT&CK techniques (T1005, T1033, T1041), and is covered by 9 detection rules and 36 indicators of compromise.

Key facts for TL-2026-1767

Threat ID
TL-2026-1767
Also known as
Gitea diffpatch Git Hook RCE, GHSA-rcr6-4jqh-j84m
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-29
Last reviewed
2026-08-29
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, softwaredevelopment, government administration, financialservices, managedserviceproviders, education
Target regions
Global
Detection rules
9
Indicators of compromise
36
Updates
2026-08-29 · 3 updates · revalidated 3× · latest source

Malware and tooling in Gitea Remote Code Execution via diffpatch Git Hook

Malware and tooling: Git 2.32+

A Gitea user with only ordinary repository-write access can abuse the diffpatch API endpoint to plant a malicious hooks/post-index-change Git hook via an add/add patch collision, achieving arbitrary command execution as the Gitea service account. Because Gitea enables open self-registration by default, an unauthenticated outside visitor can create an account and repository and meet every precondition without pre-existing credentials. Affects Gitea 1.17.0 through 1.27.0; fixed in 1.27.1 (CVSS 9.8, CWE-94). Public PoC code is available; no confirmed in-the-wild exploitation as of 2026-07-29.

How Gitea Remote Code Execution via diffpatch Git Hook works

CVE-2026-60004 (GHSA-rcr6-4jqh-j84m) is a critical remote code execution vulnerability in Gitea's diffpatch functionality, implemented in services/repository/files/patch.go and exposed via the POST /api/v1/repos/{owner}/{repo}/diffpatch API endpoint. The endpoint applies an attacker-supplied patch inside a shared bare temporary repository. When the same patch is submitted twice, Git's three-way merge fallback (active on Git 2.32 and newer) checks out the colliding add/add path to the filesystem despite the request using the --cached flag. Because the temporary repository is a bare repository, its root directory is equal to $GIT_DIR, so the checked-out path can land inside hooks/. By naming the colliding path hooks/post-index-change and making it executable, the attacker installs a live Git hook that Git automatically invokes the next time the index is updated, running attacker-chosen shell commands with the privileges of the Gitea operating-system service account.

The public proof-of-concept (gitea_diffpatch_rce_poc.py) demonstrates the full chain: authenticate to the target Gitea instance (existing or newly self-registered account), initialize a repository, submit the crafted patch twice to trigger the hook installation, and then retrieve command output without any outbound network callback — the hook writes the output into Git objects, creates a branch containing the result, and the attacker fetches it back over authenticated Git smart HTTP. This makes the exploit fully self-contained within Gitea's own legitimate protocol traffic, complicating network-based detection.

The vulnerability's practical severity is amplified by Gitea's default configuration: self-registration is enabled out of the box, with no email verification, no manual approval step, and no default restriction on new accounts or repository creation. This collapses the nominal "requires repository write access" prerequisite into "requires only network access to the login page" on any unmodified installation, making the flaw effectively unauthenticated pre-exploitation. Exploitation additionally requires Git 2.32 or later on the server and a writable, executable temporary filesystem, both common on default installs.

Successful exploitation grants OS-level command execution as the Gitea service account, which on a typical deployment can expose application secrets in app.ini (JWT/OAuth signing keys, mailer and storage credentials), process environment variables, the underlying SQLite/MySQL/PostgreSQL database (issues, private repositories, session tokens, 2FA secrets, OAuth application secrets), and any reachable internal services depending on network isolation of the host.

The same researcher, Shai Rod (NightRang3r), concurrently reported a related but separately-tracked file-inclusion weakness in Gitea's Org-mode renderer: a crafted #+INCLUDE directive could cause the server to read and return arbitrary filesystem paths (demonstrated against /etc/passwd on a Gitea 1.27.0 host). Gitea did not assign a separate CVE for this issue but fixed it in the same 1.27.1 release by making #+INCLUDE paths render as plain text instead of being read from the server filesystem.

Gitea shipped the fix on 2026-07-26 (merged and backported), released as version 1.27.1 on 2026-07-27 (with Gitea Cloud auto-upgraded), and published the GHSA-rcr6-4jqh-j84m advisory on 2026-07-28 crediting NightRang3r. As of 2026-07-29 there is no confirmed in-the-wild exploitation, but the combination of a CVSS 9.8 score, public working PoC, a widely self-hosted DevOps platform, and a default configuration that removes the authentication barrier makes rapid patching a priority. This also lands amid a broader run of critical Gitea disclosures in July 2026, including CVE-2026-58443 (public-only repository tokens able to update private PR head branches and trigger private Actions workflows, fixed in 1.27.0), underscoring an active period of scrutiny on Gitea's API authorization model.

MITRE ATT&CK techniques used in TL-2026-1767

Collection

T1005 Data from Local System; T1074.001 Data Staged

Discovery

T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070.004 Indicator Removal; T1564 Hide Artifacts

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Command and Control

T1102 Web Service; T1105 Ingress Tool Transfer

Persistence

T1136 Create Account; T1543 Create or Modify System Process; T1546 Event Triggered Execution

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1496 Resource Hijacking; T1496.001 Resource Hijacking

Credential Access

T1552 Unsecured Credentials; T1552.001 Unsecured Credentials

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities; T1588.001 Obtain Capabilities; T1588.005 Obtain Capabilities

Reconnaissance

T1595 Active Scanning; T1595.002 Active Scanning

Affected products and versions in Gitea Remote Code Execution via diffpatch Git Hook

  • Gitea — Gitea
    Vulnerable versions: 1.17.0 - 1.27.0
    Fixed in: 1.27.1

Remediation for Gitea Remote Code Execution via diffpatch Git Hook

Patches

  • Upgrade to Gitea 1.27.1, which fixes CVE-2026-60004 and the related unassigned Org-mode #+INCLUDE file-inclusion issue

Immediate actions

  • Upgrade all Gitea instances to version 1.27.1 or later immediately
  • Disable open self-registration (service.DISABLE_REGISTRATION=true) to remove the unauthenticated account-creation path while patching — this does not remove risk from existing users who already hold repository write access
  • Audit existing repository-write-level accounts and recent diffpatch API activity for duplicate/colliding patch submissions or newly created files under hooks/
  • Restrict or add monitoring/WAF rules around POST /api/v1/repos/{owner}/{repo}/diffpatch until patched

Workarounds

  • Disable or restrict the diffpatch route/feature if not required by your workflow
  • Disable public self-registration to remove the unauthenticated attack path
  • Network-isolate the Gitea host from sensitive internal services and secrets pending patch deployment

Longer-term hardening

  • Mount Gitea's temporary/working directories noexec where feasible to break the writable+executable precondition the exploit depends on
  • Deploy host/EDR monitoring on the Gitea service account to alert on unexpected child processes spawned from the Gitea binary or from within .git/hooks paths
  • Enforce least-privilege on the Gitea service account and isolate high-value secrets (do not co-locate app.ini secrets with broadly reachable database/OAuth credentials)
  • Establish a patch-management SLA for self-hosted Git/DevOps tooling given the frequency of critical Gitea CVEs in 2026 (CVE-2026-58443, CVE-2026-60004)

CVEs associated with Gitea Remote Code Execution via diffpatch Git Hook

CVE-2026-60004, CVE-2026-59774

Weaknesses (CWE) in Gitea Remote Code Execution via diffpatch Git Hook

CWE-94

Timeline of Gitea Remote Code Execution via diffpatch Git Hook

  • Gitea 1.17.0 released, marking the start of the version range later found vulnerable to CVE-2026-60004.
  • Gitea 1.26.3 released (1.26.4 followed with one more fix), patching seven unrelated CVEs including an insecure-default X-WEBAUTH-USER auth-bypass in Docker images, incomplete webhook/migration SSRF protection, branch write-permission caching, fork-sync issues, TOTP replay, LFS object-reuse access control, and RSS/Atom feed token scope enforcement — showing the active patch cadence Gitea maintained in the weeks leading up to the diffpatch RCE disclosure.
  • Gitea 1.27.0 released with a large batch of security fixes (including the fix for the unrelated CVE-2026-58443 public-token PR branch issue); the diffpatch RCE remained unpatched in this release.
  • GHSA-xxjv-752h-3vp2 (CVE-2026-58443, CVSS 9.6) published: a public-only write:repository token could update a private pull-request head branch via the public base repository's POST /api/v1/repos/{public-owner}/{public-repo}/pulls/{index}/update endpoint and trigger private Actions workflows; fixed in 1.27.0. A concurrent critical Gitea API-authorization flaw from the same disclosure window as CVE-2026-60004.
  • Security media (securityonline.info and others) publish detailed coverage and PoC exploit-code analysis of CVE-2026-58443, amplifying scrutiny of Gitea's API authorization model shortly before the diffpatch RCE advisory.
  • Fix for the diffpatch Git hook RCE merged and backported by the Gitea maintainers.
  • Gitea 1.27.1 released, fixing CVE-2026-60004 and the related unassigned Org-mode #+INCLUDE file-inclusion issue; Gitea Cloud auto-upgraded.
  • An independent second public PoC (0xBlackash/CVE-2026-60004 on GitHub) begins circulating alongside the GHSA-referenced gitea_diffpatch_rce_poc.py, further lowering the barrier to reproduce the attack.
  • GHSA-rcr6-4jqh-j84m security advisory published crediting researcher Shai Rod (NightRang3r); CVE-2026-60004 assigned, CVSS 9.8, public PoC included.
  • The Hacker News and other outlets report on the vulnerability; no confirmed in-the-wild exploitation observed as of this date.
  • Per this newer report's sourcing, the Habr write-up documenting the Gitea 1.24.7 cryptomining compromise was published 2026-08-22, ahead of the 2026-08-26 date on the existing 'cryptomining_incident_disclosed' entry; exact publish date is recorded as an open sourcing discrepancy, not a correction.
  • Under Binding Operational Directive 26-04, CISA sets a remediation deadline of 2026-08-28 for Federal Civilian Executive Branch agencies running affected Gitea instances.
  • CISA adds CVE-2026-60004 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
  • BleepingComputer and The Hacker News report on active cryptomining exploitation of unpatched Gitea servers, noting Shadowserver tracks roughly 5,000 internet-exposed Gitea instances.
  • Developer Andrey (@Causelof) publishes a Habr write-up detailing how an unknown attacker exploited CVE-2026-60004 to deploy a cryptomining dropper on their Gitea VPS, discovered after hosting provider HOSTKEY flagged sustained CPU usage above 70%.
  • Shadowserver's internet-wide scan finds 8,393 IPs still running vulnerable Gitea out of over 400,000 total installations tracked, refining the 2026-08-26 estimate of ~5,000 exposed instances on file.
  • BleepingComputer publishes coverage of the 8,300+ vulnerable exposed Gitea servers, coinciding with the CISA BOD 26-04 federal remediation deadline.
  • CISA BOD 26-04 remediation deadline for Federal Civilian Executive Branch agencies to patch CVE-2026-60004.

Update history for TL-2026-1767

Sources cited for Gitea Remote Code Execution via diffpatch Git Hook

Threats related to Gitea Remote Code Execution via diffpatch Git Hook

Detection coverage for TL-2026-1767

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1767 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats