CVE-2026-60004

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-60004 9.8

Gitea · Gitea · Added 2026-08-25 · Published 2026-07-25

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityGitea Code Injection Vulnerability

VendorGitea

ProductGitea

Date added2026-08-25

Due date2026-08-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-94

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-25 21:14 UTC

Searches4

Component defaultyes

Sources https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
https://github.com/EQSTLab/CVE-2026-60004
https://github.com/imbas007/CVE-2026-60004-POC
https://github.com/shinthink/CVE-2026-60004
https://thehackernews.com/2026/07/new-gitea-rce-lets-repository-writers.html
https://securityonline.info/gitea-rce-cve-2026-60004/
https://www.cycognito.com/blog/emerging-threat-cve-2026-60004-gitea-remote-code-execution-via-diffpatch-git-hooks/

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt for POST requests to the /diffpatch API endpoint from new Gitea accounts, then look for hooks/post-index-change files in repository dirs and unexpected Git fetches returning branch data from the Gitea service account.

Research details

Componentdiffpatch endpoint (services/repository/files/patch.go) — git apply --cached in shared bare temporary clone

PreconditionsGitea version 1.17 through 1.27.0 with the diffpatch route enabled; Git 2.32 or newer on the server (enables the -3 three-way merge fallback); repository write access (obtainable by registering an account when open registration is enabled, which is the default); the temporary clone filesystem must be writable and executable. agent

DeliveryHTTP POST to /api/v1/repos/{owner}/{repo}/diffpatch with a crafted patch payload (identical patch submitted twice to trigger -3 fallback)

Public PoCyes

PoC URLs https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
https://github.com/EQSTLab/CVE-2026-60004
https://github.com/imbas007/CVE-2026-60004-POC
https://github.com/shinthink/CVE-2026-60004 Third-party repos; verify before use.

Advisoryhttps://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m

Exploit notesMultiple public PoCs available (Python and Docker-based). The exploit submits the same patch twice to trigger Git's -3 three-way merge fallback, which checks out an executable hooks/post-index-change file into the bare clone's working tree ($GIT_DIR), making it a live Git hook. Command output is stored in Git objects and fetched via authenticated smart HTTP — no outbound connection required. With default open registration, the attacker needs no prior credentials. CVSS 9.8 CRITICAL.

SummaryGitea versions 1.17 through 1.27.0 are vulnerable to remote code execution via the diffpatch API endpoint (CWE-94). The endpoint applies attacker-controlled patches in a shared bare temporary clone using git apply --cached; submitting the same patch twice triggers Git's -3 three-way merge fallback, which checks out an executable hooks/post-index-change file that becomes a live Git hook executing arbitrary commands as the Gitea service account. With default open registration, an unauthenticated visitor can register, create a repository, and exploit the chain; command output is exfiltrated via Git objects and authenticated smart HTTP fetches. Gitea 1.27.1 patches this; CVSS 9.8 CRITICAL with multiple public PoCs available.

Tia coverage

First reported2026-08-25

First exploit report2026-08-28

Exploit report → KEV3 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

red-heron-hackers-exploit-critical-gitea-rce-to-steal-source-cod

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.