# Gitea Remote Code Execution via diffpatch Git Hook Installation (CVE-2026-60004)

> A Gitea user with only ordinary repository-write access can abuse the diffpatch API endpoint to plant a malicious hooks/post-index-change Git hook via an add/add patch collision, achieving arbitrary command execution as the Gitea service account. Because Gitea enables open self-registration by default, an unauthenticated outside visitor can create an account and repository and meet every precondition without pre-existing credentials. Affects Gitea 1.17.0 through 1.27.0; fixed in 1.27.1 (CVSS 9.8, CWE-94). Public PoC code is available; no confirmed in-the-wild exploitation as of 2026-07-29.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-08-29T08:52:04.365Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1767
- **ID:** TL-2026-1767
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-60004, CVE-2026-59774

## Description

CVE-2026-60004 (GHSA-rcr6-4jqh-j84m) is a critical remote code execution vulnerability in Gitea's diffpatch functionality, implemented in services/repository/files/patch.go and exposed via the POST /api/v1/repos/{owner}/{repo}/diffpatch API endpoint. The endpoint applies an attacker-supplied patch inside a shared bare temporary repository. When the same patch is submitted twice, Git's three-way merge fallback (active on Git 2.32 and newer) checks out the colliding add/add path to the filesystem despite the request using the --cached flag. Because the temporary repository is a bare repository, its root directory is equal to $GIT_DIR, so the checked-out path can land inside hooks/. By naming the colliding path hooks/post-index-change and making it executable, the attacker installs a live Git hook that Git automatically invokes the next time the index is updated, running attacker-chosen shell commands with the privileges of the Gitea operating-system service account.

The public proof-of-concept (gitea_diffpatch_rce_poc.py) demonstrates the full chain: authenticate to the target Gitea instance (existing or newly self-registered account), initialize a repository, submit the crafted patch twice to trigger the hook installation, and then retrieve command output without any outbound network callback — the hook writes the output into Git objects, creates a branch containing the result, and the attacker fetches it back over authenticated Git smart HTTP. This makes the exploit fully self-contained within Gitea's own legitimate protocol traffic, complicating network-based detection.

The vulnerability's practical severity is amplified by Gitea's default configuration: self-registration is enabled out of the box, with no email verification, no manual approval step, and no default restriction on new accounts or repository creation. This collapses the nominal "requires repository write access" prerequisite into "requires only network access to the login page" on any unmodified installation, making the flaw effectively unauthenticated pre-exploitation. Exploitation additionally requires Git 2.32 or later on the server and a writable, executable temporary filesystem, both common on default installs.

Successful exploitation grants OS-level command execution as the Gitea service account, which on a typical deployment can expose application secrets in app.ini (JWT/OAuth signing keys, mailer and storage credentials), process environment variables, the underlying SQLite/MySQL/PostgreSQL database (issues, private repositories, session tokens, 2FA secrets, OAuth application secrets), and any reachable internal services depending on network isolation of the host.

The same researcher, Shai Rod (NightRang3r), concurrently reported a related but separately-tracked file-inclusion weakness in Gitea's Org-mode renderer: a crafted #+INCLUDE directive could cause the server to read and return arbitrary filesystem paths (demonstrated against /etc/passwd on a Gitea 1.27.0 host). Gitea did not assign a separate CVE for this issue but fixed it in the same 1.27.1 release by making #+INCLUDE paths render as plain text instead of being read from the server filesystem.

Gitea shipped the fix on 2026-07-26 (merged and backported), released as version 1.27.1 on 2026-07-27 (with Gitea Cloud auto-upgraded), and published the GHSA-rcr6-4jqh-j84m advisory on 2026-07-28 crediting NightRang3r. As of 2026-07-29 there is no confirmed in-the-wild exploitation, but the combination of a CVSS 9.8 score, public working PoC, a widely self-hosted DevOps platform, and a default configuration that removes the authentication barrier makes rapid patching a priority. This also lands amid a broader run of critical Gitea disclosures in July 2026, including CVE-2026-58443 (public-only repository tokens able to update private PR head branches and trigger private Actions workflows, fixed in 1.27.0), underscoring an active period of scrutiny on Gitea's API authorization model.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1136 Create Account
- T1059 Command and Scripting Interpreter
- T1546 Event Triggered Execution
- T1068 Exploitation for Privilege Escalation
- T1564 Hide Artifacts
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1005 Data from Local System
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1210 Exploitation of Remote Services
- T1496 Resource Hijacking
- T1078 Valid Accounts
- T1057 Process Discovery
- T1105 Ingress Tool Transfer
- T1059.004 Command and Scripting Interpreter
- T1552.001 Unsecured Credentials
- T1588.001 Obtain Capabilities
- T1595.002 Active Scanning
- T1543 Create or Modify System Process
- T1070.004 Indicator Removal
- T1033 System Owner/User Discovery
- T1074.001 Data Staged
- T1588.005 Obtain Capabilities
- T1496.001 Resource Hijacking

## Sources

- [New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands](https://thehackernews.com/2026/07/new-gitea-rce-lets-repository-writers.html)
- [GHSA-rcr6-4jqh-j84m: Remote Code Execution via diffpatch Git Hook Installation](https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m)
- [Release v1.27.1 · go-gitea/gitea](https://github.com/go-gitea/gitea/releases/tag/v1.27.1)
- [New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands](https://www.guardianmssp.com/2026/07/29/new-gitea-rce-lets-repository-writers-plant-a-git-hook-to-run-shell-commands/)
- [Misconfigured Gitea Abuse - Cloud Threat Landscape](https://threats.wiz.io/all-techniques/misconfigured-gitea-abuse)
- [CVE-2026-58443: Gitea Flaw (CVSS 9.6) Details and PoC Exploit Code Publicly Disclosed](https://securityonline.info/gitea-vulnerability/)
- [Gitea 1.27.0 is released](https://blog.gitea.com/release-of-1.27.0/)
- [Gitea 1.17.0 is released](https://blog.gitea.com/2022/07/gitea-1.17.0-is-released/)
- [GHSA-xxjv-752h-3vp2: Public-only repository tokens can update private PR head branches](https://github.com/go-gitea/gitea/security/advisories/GHSA-xxjv-752h-3vp2)
- [Gitea 1.26.3 and 1.26.4 are released](https://blog.gitea.com/release-of-1.26.3-and-1.26.4/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1767