Full Report
Gitea security advisory (AV26-845)
Analysis Summary
# Vulnerability: Remote Code Execution via diffpatch Git Hook Installation in Gitea
## CVE Details
- **CVE ID:** CVE-2026-60004
- **CVSS Score:** 9.8 (Critical) *(Assigned based on RCE impact and KEV status)*
- **CWE:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command) / CWE-20 (Improper Input Validation)
## Affected Systems
- **Products:** Gitea
- **Versions:** All versions prior to 1.27.1
- **Configurations:** Systems where users have permissions to manage repositories or interact with Git hooks/diff processing features.
## Vulnerability Description
The vulnerability stems from a flaw in how Gitea handles the `diffpatch` mechanism during Git hook installations. An attacker can bypass input validation to inject malicious commands into the Git hook configuration. Because Git hooks are executed by the underlying server OS during various Git operations (like pushes or merges), this leads to **Remote Code Execution (RCE)** under the context of the user running the Gitea service.
## Exploitation
- **Status:** **Exploited in the wild.** (Added to CISA Known Exploited Vulnerabilities catalog on August 25, 2026).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to repository data and potentially server environment)
- **Integrity:** High (Ability to modify codebases and system files)
- **Availability:** High (Potential for system-wide denial of service or ransomware)
## Remediation
### Patches
The following versions contain the fix for this vulnerability. Users are urged to upgrade immediately:
- **Gitea 1.27.1**
- **Gitea 1.27.2** (Recommended, as it includes additional stability fixes)
### Workarounds
- **Disable Git Hooks:** If upgrading is not immediately possible, disable the ability for users to create or edit Git hooks in the `app.ini` configuration by setting `DISABLE_GIT_HOOKS = true`.
- **Restrict Permissions:** Audit user accounts and remove repository administrative privileges from untrusted or non-essential accounts.
## Detection
- **Indicators of Compromise:**
- Unusual scripts or binary files appearing in the `hooks` directory of repositories on the server filesystem.
- Unexpected outbound network connections originating from the Gitea service user.
- Audit logs showing unauthorized modifications to repository settings or hooks by unexpected user accounts.
- **Detection Methods:** Monitor for Gitea process child execution (e.g., `gitea` spawning `sh`, `bash`, or `python` unexpectedly).
## References
- **Vendor Advisory:** [https://github[.]com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m]
- **Release Notes 1.27.1:** [https://blog[.]gitea[.]com/release-of-1.27.1/]
- **Release Notes 1.27.2:** [https://blog[.]gitea[.]com/release-of-1.27.2/]
- **CISA KEV Catalog:** [https://www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004]
- **Canadian Centre for Cyber Security:** [https://www[.]cyber[.]gc[.]ca/en/alerts-advisories/gitea-security-advisory-av26-845]