Critical Gitea RCE Vulnerability CVE-2026-60004 Allows Repository Writers to Execute Shell Commands via Git Hooks

A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-60004 with a CVSS score of 9.8, has been patched in Gitea, the self-hosted Git platform. The flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in version 1.27.1. It allows a user with ordinary repository write access to plant a Git hook by submitting attacker-controlled patch content, enabling shell command execution as the Gitea service account.

The vulnerability resides in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint. Vulnerable builds invoke git apply with options including –index, –recount, –cached, and –binary, and add the -3 three-way fallback option when the server runs Git 2.32 or later. An attacker submits the same patch twice to create an add/add collision. The three-way fallback then checks the indexed path out even though the operation uses –cached. Because the temporary clone is bare, its root is $GIT_DIR. An executable file placed at hooks/post-index-change lands in Git’s hook directory and becomes active, with Git running it while updating the index.

Gitea enables registration by default, so an outside visitor can create a normal account and repository on an unchanged installation, then exploit the bug without pre-existing credentials. The proof-of-concept (PoC) code signs in with a normal account, creates an initialized private repository, sends the malicious patch twice, and retrieves the command output. It needs no outbound callback; the hook stores the output in Git objects, creates a branch containing the result, and lets the attacker fetch it over authenticated smart HTTP.

Successful exploitation gives the attacker the privileges of the Gitea operating-system account, potentially exposing application and environment secrets, mounted repositories, database credentials and contents, OAuth credentials, and reachable internal services. The fix changes the temporary clone from bare to non-bare, with a code comment explicitly warning that Git commands using –index may operate on the working tree. The change was merged and backported on July 26, 2026, with version 1.27.1 shipping on July 27 and the security advisory following on July 28. The release notes listed the change under MISC as ‘refactor: git patch apply,’ not under SECURITY.

Gitea Cloud instances were upgraded automatically. Disabling open registration can remove the public account-creation path while the update is deployed, but it does not fix the flaw or protect against existing users with repository write access. The flaw was reported by security researcher Shai Rod (NightRang3r). As of July 29, 2026, none of the cited primary sources reports whether the flaw was exploited before or after version 1.27.1 became available.