CVE-2026-60004
Description
Critical RCE in Gitea (CVSS 9.8) allows attackers to execute commands via the diffpatch API. Actively exploited; update to version 1.27.1 immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| gitea | 1.17.0 | 1.27.1 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately upgrade Gitea to version 1.27.1 or later. This release contains critical security fixes that sanitize inputs to the diffpatch API and prevent unauthorized Git hook installation.
Update affected systems
Identify all Gitea instances running versions 1.17.0 through 1.27.0. Ensure these systems are updated to the latest stable version to mitigate the risk of remote code execution.
Restrict access
Limit network access to the Gitea web interface and API to trusted IP ranges. Additionally, ensure that 'DISABLE_GIT_HOOKS' is set to true in the Gitea configuration file to prevent any hook-based execution.
Monitor for exploitation
Audit repository directories for unauthorized scripts in the 'hooks' folder and review application logs for suspicious POST requests directed at the diffpatch API endpoint.
Detection Guidance
"Monitor Gitea application logs for unusual activity involving the `/api/v1/repos/{owner}/{repo}/diffpatch` endpoint, particularly requests originating from unauthenticated or unexpected IP addresses. Security teams should use file integrity monitoring (FIM) to detect the creation of new executable files within the Git hooks directory of hosted repositories. Additionally, inspect system process logs for unexpected shell executions (e.g., /bin/sh, /bin/bash) spawned by the Gitea service user account."