Gitea Remote Code Execution Vulnerability via diffpatch API and Git Hooks (CVE-2026-60004)

Affected Vendors

gitea

Affected Components

gitea

Published Date

2026-08-26

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Gitea versions prior to 1.27.1

Impact

Unauthenticated remote attackers can install malicious Git hooks via the diffpatch API, leading to arbitrary system command execution with Gitea server privileges.

Mitigation

Immediately upgrade Gitea instances to version 1.27.1 or later, and disable Git Hook functionality in the configuration.

Affected Products & Version Scope

All Gitea versions prior to 1.27.1

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Apply Official Security Patch

Immediately upgrade your Gitea instances to version 1.27.1 or later.

2. Temporary Mitigation (If patching is delayed)

Disable Git Hooks

Disable global and custom Git Hook execution by modifying the Gitea configuration file (app.ini):

ini

[security]
DISABLE_GIT_HOOKS = true

WAF (Web Application Firewall) Rules

Block external access to the vulnerable diffpatch API endpoint until the patch is applied:

Block URI Pattern: /api/v1/repos/{owner}/{repo}/diffpatch (and related diffpatch API routes)

Recommended Security Control & Mitigation Partner

Snyk Open Source & Container Security

This vulnerability is actively exploited in the wild; immediately upgrade Gitea to 1.27.1+ or set DISABLE_GIT_HOOKS to true in app.ini.

Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds

Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.

Free Forever Tier · 1-Click GitHub/GitLab Auto-PR

Scan Your Git Repositories for Free

Master DevSecOps: Automated SAST/SCA in GitHub Actions & Kubernetes

View Course Curriculum

Technical Root Cause & Exploitation Mechanics

Vulnerability Overview

A critical Remote Code Execution (RCE) vulnerability exists in Gitea's diffpatch API endpoint due to insufficient input validation. Attackers can exploit this vulnerability to force the installation and injection of malicious Git hooks into target repositories.

Attack Mechanism & Root Cause (CWE-94)

Lack of Input Validation: The diffpatch API in Gitea fails to properly sanitize patch files, allowing path traversal or arbitrary file write operations.
Git Hook Injection: Attackers leverage this flaw to write or overwrite executable scripts (such as pre-receive, update, or post-receive) inside the repository's .git/hooks directory.
Code Execution: When a subsequent Git event (e.g., a push operation) triggers the modified hook, the injected shell commands execute under the context of the Gitea server process.

Threat Severity

This vulnerability is rated as Critical with a CVSS score of 9.8. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active in-the-wild exploitation. The EPSS score of 0.94 further highlights the extreme urgency of remediation.