---
title: "Gitea CVE-2026-60004: Exploited RCE via diffpatch API"
url: https://erroneo.us/security/briefs/gitea-cve-2026-60004-diffpatch-git-hook-rce/
description: "Any user who can create a repo can run shell commands on Gitea 1.17-1.27.0 hosts; open sign-up makes it unauthenticated. Exploited, in KEV. Upgrade now."
type: security-brief
section: "Security Digest"
date_published: 2026-07-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-60004"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Gitea CVE-2026-60004: Exploited RCE via diffpatch API

**Verdict: Act now.** Upgrade every self-hosted Gitea below 1.27.1 today and close open registration; automated attacks sign up, create a repo and get a shell in seconds, and a proof of concept is public.

- **Who must act:** Every self-hosted Gitea instance from 1.17 through 1.27.0, most urgently internet-facing ones with open self-registration; Forgejo admins should confirm they are on 15.0.9 / 16.0.5 or later.
- **Who can relax:** Instances already on Gitea 1.27.1, 1.27.3 or the renumbered 28.x line, provided nothing was planted before the upgrade.
- **Affected:** Gitea 1.17 through 1.27.0; Forgejo v15 before 15.0.6 (fix credited to the Gitea advisory); related critical diffpatch variant in Forgejo before 15.0.9 / 16.0.5
- **Fixed:** Gitea 1.27.1 (current: 28.2.0); Forgejo 15.0.9 / 16.0.5 (current: 15.0.10 / 16.0.6)
- **CVEs:** CVE-2026-60004
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version (gitea --version or GET /api/v1/version) and upgrade to 1.27.1 or later; current releases are 1.27.3 and 28.2.0.
2. Set DISABLE_REGISTRATION = true in app.ini (or require email confirmation and CAPTCHA) unless public sign-up is essential.
3. Review accounts created recently and their repositories; remove anything you do not recognize.
4. If compromise is possible, rotate app.ini secrets, the database password, OAuth and integration tokens, and any credentials in the Gitea environment.
5. Run Gitea unprivileged in a container with restricted egress, and on Forgejo upgrade to 15.0.9 / 16.0.5 or later.

### How to check if you are affected

- Search Gitea logs for POST /api/v1/repos/<owner>/<repo>/diffpatch, especially repeated calls from accounts registered minutes earlier.
- Look for files at */hooks/post-index-change under Gitea's data and temp directories.
- Look for unexpected branches (e.g. rce-proof) or throwaway repos (e.g. poc-*) created by new accounts.
- Watch for sustained high CPU, unknown processes or outbound downloads from the Gitea service account.

## What happened

On July 27, 2026, Gitea released [1.27.1](https://blog.gitea.com/release-of-1.27.1/) with fixes for two CVEs and asked users to "upgrade as soon as possible". The more serious one is CVE-2026-60004, explained the next day in [GHSA-rcr6-4jqh-j84m](https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m) (CVSS 3.1 9.8). Gitea's `diffpatch` API applies a user-supplied patch inside a temporary bare Git repository. A crafted patch can leave behind an executable Git hook in that repository. Git then runs the hook, giving the attacker shell commands as the Gitea service account. NightRang3r reported the bug, and the published advisory includes a working proof of concept.

The attacker needs only ordinary write access to one repository. The advisory notes that self-registration is open by default, so anyone can sign up, create a repository and attack an instance without any prior credentials.

## Who is affected

Gitea 1.17 through 1.27.0 is affected, per the advisory and the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-60004). The advisory lists three conditions, all common: Git 2.32 or newer on the host, the `diffpatch` route enabled, and a writable, executable temp directory. Gitea did not ship a 1.26 backport. The last 1.26 release predates the fix, so older installs must move to 1.27.1 or later. Since then Gitea has released 1.27.2 and 1.27.3 and switched to new version numbers, with 28.0.0 through 28.2.0 on its [releases page](https://github.com/go-gitea/gitea/releases).

**Forgejo**, the Gitea fork, backported a fix crediting this advisory to its v15 LTS branch in 15.0.6 on July 30 ([PR #13705](https://codeberg.org/forgejo/forgejo/pulls/13705)). The same-day v16.0.2 notes do not list it. Forgejo had moved Git hooks to a central location in v16.0, and its notes do not say whether v16 was affected. On September 17, both branches fixed a critical variant in the same patch-application code that also allowed remote code execution ([15.0.9](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.9.md) and 16.0.5). Forgejo admins should be on at least those releases. The current releases are 15.0.10 and 16.0.6.

## Do you really need to act?

Yes. A self-hosted Git server holds source code, deploy keys, CI secrets and OAuth tokens, and the advisory warns that `app.ini`, environment secrets and database credentials may be exposed. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004) on August 25 with a three-day deadline. That day [runZero](https://www.runzero.com/blog/gitea/) noted evidence of active exploitation.

The clearest public case is an [incident write-up on Habr](https://habr.com/ru/articles/1072030/) dated August 19. A studio's Gitea 1.24.7 server had open registration with no email confirmation and no CAPTCHA. An automated scanner registered an account, created a private repository, triggered the bug and confirmed code execution as the `git` user, in about 11 seconds. It then ran a miner-like payload that the host's provider noticed as sustained CPU load. Docker confinement and an unprivileged container limited the damage. [Help Net Security](https://www.helpnetsecurity.com/2026/08/26/gitea-cve-2026-60004-exploited-in-the-wild/) notes that no actor has been publicly attributed.

Instances with closed registration and trusted users are at lower risk, but any account with write access, including a compromised one, is enough.

## What to do now

1. Check the version with `gitea --version` or `curl -s https://<host>/api/v1/version`, then upgrade to 1.27.1 or later (1.27.3 or 28.2.0 are current) by updating your binary or `gitea/gitea` image tag.
2. In `app.ini`, under `[service]`, set `DISABLE_REGISTRATION = true`. If sign-up must stay open, at least set `REGISTER_EMAIL_CONFIRM = true` and `ENABLE_CAPTCHA = true`.
3. Audit users created since late July, and their repositories and branches.
4. If anything looks wrong, rotate the secrets in `app.ini`, the database password, OAuth and integration tokens, and deploy keys.
5. Run Gitea as an unprivileged container with restricted egress. On Forgejo, upgrade to 15.0.9 or 16.0.5 or later.

## How to tell if you were hit

Search Gitea logs (`docker logs gitea`, or `gitea.log` and `access.log` in the log directory) for POST requests to `/api/v1/repos/<owner>/<repo>/diffpatch`. Pay most attention to repeated calls seconds after a `/user/sign_up` and a repository creation from the same client. Look for files named `post-index-change` under any `hooks/` directory in Gitea's data or temp paths. Check for odd branches such as `rce-proof` and repositories named `poc-*`, the names seen in the Habr incident. Sustained CPU load, unknown processes or downloads run as the Gitea user are strong signs of compromise. In that case, rebuild the host or container and rotate credentials rather than cleaning up in place.

## Timeline

- Jul 27, 2026 — Gitea 1.27.1 released with the fix.
- Jul 28, 2026 — GitHub advisory with proof of concept published.
- Jul 30, 2026 — Forgejo 15.0.6 backports a fix.
- Aug 19, 2026 — Habr incident report of a cryptominer compromise.
- Aug 25, 2026 — CISA adds CVE-2026-60004 to KEV.
- Aug 26, 2026 — CVE record published.
- Aug 28, 2026 — CISA remediation deadline for federal agencies.
- Sep 17, 2026 — Forgejo 15.0.9 and 16.0.5 fix a critical diffpatch variant.

## Sources

1. [Gitea — GHSA-rcr6-4jqh-j84m: Remote Code Execution via diffpatch Git Hook Installation](https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m)
2. [Gitea — Gitea 1.27.1 is released](https://blog.gitea.com/release-of-1.27.1/)
3. [CVE record — CVE-2026-60004](https://www.cve.org/CVERecord?id=CVE-2026-60004)
4. [NVD — CVE-2026-60004](https://nvd.nist.gov/vuln/detail/CVE-2026-60004)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-60004](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004)
6. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Aug 25, 2026)](https://www.cisa.gov/news-events/alerts/2026/08/25/cisa-adds-one-known-exploited-vulnerability-catalog)
7. [Gitea — Releases](https://github.com/go-gitea/gitea/releases)
8. [Forgejo — PR #13705: fix: disable hooks during diff patch (v15.0)](https://codeberg.org/forgejo/forgejo/pulls/13705)
9. [Forgejo — 15.0.9 release notes](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/15.0.9.md)
10. [Habr — Incident report: cryptominer on a self-hosted Gitea via CVE-2026-60004 (Russian)](https://habr.com/ru/articles/1072030/)
11. [runZero — Gitea vulnerability CVE-2026-60004: find impacted assets](https://www.runzero.com/blog/gitea/)
12. [Help Net Security — Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)](https://www.helpnetsecurity.com/2026/08/26/gitea-cve-2026-60004-exploited-in-the-wild/)

---
Source page: https://erroneo.us/security/briefs/gitea-cve-2026-60004-diffpatch-git-hook-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt