Full Report
Attackers are now exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). [...]
Analysis Summary
# Vulnerability: Gitea Code Injection via diffpatch API
## CVE Details
- **CVE ID:** CVE-2026-60004
- **CVSS Score:** Critical (Numerical score not explicitly stated, but categorized as "Critical" severity by CISA/Gitea)
- **CWE:** CWE-94 (Improper Control of Generation of Code / Code Injection)
## Affected Systems
- **Products:** Gitea (Self-hosted Git service)
- **Versions:** All versions prior to 1.27.1
- **Configurations:**
- Vulnerable by default due to enabled self-registration.
- Any instance where an attacker can obtain repository write access.
## Vulnerability Description
A code injection flaw exists within the Gitea `diffpatch` API endpoint. The vulnerability allows an attacker with write access to a repository to abuse the endpoint to install and execute a Git hook using repository-controlled content. This results in the execution of arbitrary shell commands within the context of the Gitea operating system service account.
## Exploitation
- **Status:** Exploited in the wild (Added to CISA KEV Catalog). Reports indicate deployment of cryptocurrency mining malware.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
- **Authentication:** Required (However, easily bypassed via default self-registration settings).
## Impact
- **Confidentiality:** High (Full access to repository data and server files via shell access)
- **Integrity:** High (Ability to modify codebases and system configurations)
- **Availability:** High (Potential for system takeover or service disruption)
## Remediation
### Patches
- **Upgrade to Gitea version 1.27.1** or later immediately.
### Workarounds
- **Disable Self-Registration:** If patching is delayed, disable the ability for unauthenticated users to register accounts to prevent them from gaining the necessary write access.
- **Restrict Write Access:** Audit and restrict repository write permissions to trusted users only.
## Detection
- **Indicators of Compromise:**
- Unusual shell activity or unauthorized processes (e.g., miners) originating from the Gitea service user.
- Unauthorized account registrations in Gitea logs.
- Unexplained modifications to Git hooks within repositories.
- **Detection methods and tools:**
- Monitor logs for unusual POST requests to the `/diffpatch` endpoint.
- Review CISA KEV Catalog updates for further behavioral patterns.
## References
- **Vendor Advisory:** hxxps[://]github[.]com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
- **Gitea Release Blog:** hxxps[://]blog[.]gitea[.]com/release-of-1.27.1/
- **CISA KEV Catalog:** hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Shadowserver Statistics:** hxxps[://]dashboard[.]shadowserver[.]org/statistics/iot-devices/time-series/?date_range=30&vendor=gitea&model=gitea&dataset=count&limit=100&group_by=geo&stacking=stacked&auto_update=on