Gitea, the widely-used self-hosted Git service, has recently addressed a critical remote code execution (RCE) vulnerability identified as CVE-2026-60004, carrying a CVSS score of 9.8. This flaw enables users with repository write access to execute arbitrary shell commands on the server, posing significant security risks.
The vulnerability affects Gitea versions from 1.17 up to, but not including, 1.27.1. It resides in the `POST /api/v1/repos/{owner}/{repo}/diffpatch` endpoint, which processes patch files. An attacker can exploit this by submitting a specially crafted patch twice, leading to the creation of a malicious Git hook. This hook is then executed during index updates, allowing the execution of arbitrary shell commands with the privileges of the Gitea service account.
Notably, Gitea’s default configuration permits open user registration without requiring email verification or manual approval. This setting allows external users to create accounts and repositories, thereby facilitating potential exploitation without prior credentials. Even if open registration is disabled, existing users with repository write access remain vulnerable.
To mitigate this risk, Gitea has released version 1.27.1, which addresses the vulnerability by modifying the temporary clone process from bare to non-bare, preventing the unintended execution of Git hooks. Users are strongly advised to upgrade to this latest version promptly. For those unable to update immediately, disabling the `diffpatch` route and restricting user registration can serve as temporary protective measures.
While there have been no confirmed reports of this vulnerability being exploited in the wild as of July 29, 2026, the availability of public proof-of-concept code underscores the urgency of applying the patch. Successful exploitation could grant attackers access to sensitive information, including application secrets, database credentials, and internal services, depending on the server’s configuration and isolation measures.
This incident highlights the critical importance of maintaining up-to-date software and reviewing default configurations to minimize security risks. Organizations utilizing Gitea should prioritize this update and assess their security practices to prevent potential breaches.
