Gitea diffpatch API remote code execution through Git hook installation (CVE-2026-60004)

What happened

Gitea before 1.27.1 is vulnerable to remote code execution. An attacker who can reach a Gitea instance over the network can use the diffpatch API to install Git hooks, leading to arbitrary code execution on the server. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning the vulnerability is reachable over the network, requires no privileges and no user interaction, and has high impact on confidentiality, integrity and availability. It is recorded as CWE-94, code injection.

CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities catalog on 2026-08-25, with a due date of 2026-08-28. CISA SSVC marks exploitation as active and automatable with total technical impact. The record does not state that a public exploit disclosure exists; ransomware use is listed as unknown. No vendor advisory or vendor statement is included in the record.

Who is affected

Gitea versions 1.17 through before 1.27.1 are affected. If you run a Gitea instance, confirm its version; this range covers all 1.17 to pre-1.27.1 releases. The attack path is over the network and requires no prior authentication, so instances that are reachable by users, partners or the internet are the highest priority. CISA's required action also directs organisations to evaluate each asset's internet exposure and follow BOD 26-04 patching guidance.

What to do now

1. Patch to Gitea 1.27.1. This is the fixed version listed for CVE-2026-60004. The release announcement is available at https://blog.gitea.com/release-of-1.27.1/.
2. No vendor workaround is included in the record. If you cannot patch immediately, restrict network access to the Gitea instance to trusted administrative or VPN-only networks. Reducing reach is the main interim control because the flaw is exploitable over the network without credentials.
3. Treat exposed or internet-facing instances as potentially compromised because CISA KEV lists the vulnerability as exploited and SSVC marks exploitation as active. Investigate before returning them to service.
4. Follow the CISA required action for CVE-2026-60004, including the BOD 26-04 guidance on prioritising security updates and the forensics triage requirements. The KEV due date was 2026-08-28.

How to detect it

No vendor-supplied indicators of compromise are provided in the record. Because the attack path uses the diffpatch API and Git hook installation, review repositories for Git hooks that your team did not create and examine Gitea access logs for unexpected requests to the diffpatch API. Any unexplained process running on the Gitea host should be investigated.

Beyond the patch

This is an internet-reachable service with no credential requirement — the exposure pattern our Virtual CISO Services are designed to find before an attacker does. Because CISA marks it exploited, Managed Detection & Response gives you the detection and response capability for the post-exploitation activity that follows this kind of remote code execution.