Gitea RCE Flaw CVE-2026-60004 (CVSS 9.8): Details and PoC Exploit Publicly Disclosed
Do Son 
TL;DR
A critical Gitea RCE flaw now has public details and a proof-of-concept exploit. Tracked as CVE-2026-60004, it scores a CVSS of 9.8. A user with repository write access can run shell commands as the Gitea service account.
Why it matters
Gitea is a popular self-hosted Git service. Therefore many teams run it on internal code and build servers. A takeover can expose app secrets, OAuth tokens, mounted repositories, and database contents. With open registration on, even an unauthenticated visitor can reach the flaw.
How the attack works
The bug lives in the diffpatch endpoint. It applies attacker-controlled patches inside a bare temporary clone. Submitting the same patch twice triggers an add/add collision. Git’s three-way fallback then writes a file into the repository’s hook directory.
That file becomes a live Git hook named post-index-change. Git runs it while updating the index. As a result, repository content executes commands as the Gitea OS user. For safety, this report omits the exploit code and steps.
Affected versions
The Gitea RCE affects versions from 1.17 up to, but not including, 1.27.1. The trigger also needs Git 2.32 or newer and an enabled diffpatch route. The advisory classes it as code injection, CWE-94. Full details and a public proof-of-concept are out, though no in-the-wild exploitation has been confirmed.
Patch and mitigation
Update to Gitea 1.27.1 right away, since it fixes this Gitea RCE. If you cannot patch now, disable open registration to close the unauthenticated path. For the full write-up, see the GitHub Security Advisory.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
