[HIGH PRIORITY] Gitea diffpatch Git Hook RCE (CVE-2026-60004)

⚠ HIGH PRIORITY — CISA KEV (Aug 25, 2026). CVE-2026-60004 is a critical code-injection flaw in Gitea's /api/v1/repos/{owner}/{repo}/diffpatch endpoint. Attackers plant executable Git hooks via add/add patch collision — achieving RCE as the Gitea OS user. Miner-like payloads observed in active exploitation.

Affected Gitea

• Gitea versions 1.17 through 1.27.0
• Self-hosted Gitea on Linux with open registration enabled
• Git 2.32+ and writable /tmp on the Gitea server

Check version

gitea --version
curl -s http://127.0.0.1:3000/api/v1/version
grep DISABLE_REGISTRATION custom/conf/app.ini

Patching Method

1. Upgrade Gitea to 1.27.1 or later immediately.
2. Stop Gitea service: systemctl stop gitea.
3. Replace binary or pull new Docker image (gitea/gitea:1.27.1).
4. Start service and verify version in admin UI.
5. Disable open registration: set DISABLE_REGISTRATION = true in app.ini.
6. Hunt for rogue Git hooks in repository bare dirs and /tmp.
7. Rotate Gitea admin token, DB password, and SSH deploy keys.

gitea --version
grep -r 'pre-receive\|post-receive' /var/lib/gitea/data/gitea-repositories/ | head

Until patched

• Take Gitea offline if upgrade cannot happen today
• Block /api/v1/repos/*/diffpatch at reverse proxy
• Disable user registration and freeze new repo creation

CVSS: 9.8 Critical. Federal deadline: 28 Aug 2026.