Full Report
Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account. Tracked as CVE-2026-60004 (CVSS score: 9.8), the flaw affects Gitea versions 1.17 and later before 1.27.1 and is fixed in 1.27.1. The
Analysis Summary
# Vulnerability: Remote Code Execution via Malicious Git Hook in Gitea
## CVE Details
- **CVE ID:** CVE-2026-60004
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Not specified (Related to improper input validation and insecure default configuration)
## Affected Systems
- **Products:** Gitea (Self-hosted Git platform)
- **Versions:** 1.17 and later, prior to 1.27.1
- **Configurations:**
- Server running Git 2.32 or later.
- Writable and executable temporary filesystem.
- Default open registration (allows attackers to gain the required repository write access).
## Vulnerability Description
A critical flaw exists in the `POST /api/v1/repos/{owner}/{repo}/diffpatch` endpoint. The vulnerability arises because Gitea applies patches within a shared **bare** temporary clone. By submitting the same patch twice, an attacker can trigger an add/add collision.
When Git 2.32+ falls back to a three-way merge (due to the `-3` option used by Gitea), it checks the path out into the current directory. Since the temporary clone is "bare," the root of the operation is the `$GIT_DIR` itself. This allows an attacker to plant an executable file at `hooks/post-index-change`. Git then automatically executes this malicious hook while updating the index, leading to command execution under the Gitea service account.
## Exploitation
- **Status:** Public Proof-of-Concept (PoC) available; no confirmed exploitation in the wild at the time of the report.
- **Complexity:** Low (Requires repository write access, which is often available via default open registration).
- **Attack Vector:** Network (Authenticated API call).
## Impact
- **Confidentiality:** High (Access to application secrets, database contents, and source code).
- **Integrity:** High (Ability to modify repositories and database records).
- **Availability:** High (Potential for full system takeover or service disruption).
## Remediation
### Patches
- **Gitea version 1.27.1:** This version contains the fix by changing the temporary clone from a bare repository to a non-bare repository, preventing the hook directory from being mapped to the root of the patch operation.
### Workarounds
- **Disable Open Registration:** While not a fix for the underlying code flaw, disabling `ENABLE_REGISTRATION` prevents unauthenticated attackers from easily obtaining the necessary write permissions.
- **Restrict Permissions:** Ensure existing users only have the minimum necessary repository permissions.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected files in the Gitea service's temporary directories, specifically files named `post-index-change` within a `hooks` folder.
- Unusual outbound network activity or new branches created with unexpected command outputs in Git objects.
- **Detection methods:**
- Monitor Gitea logs for repeated calls to the `diffpatch` API endpoint from a single user.
- Audit Gitea service account processes for unauthorized shell command execution.
## References
- **Gitea Security Advisory:** hxxps[://]github[.]com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
- **Gitea Fix Commit:** hxxps[://]github[.]com/go-gitea/gitea/commit/470d34b1de87d901bd9135564d5ee18c0d339e82
- **Researcher Disclosure:** hxxps[://]x[.]com/NightRang3r/status/2082167303190241483
- **Primary Source:** hxxps[://]thehackernews[.]com/2026/07/new-gitea-rce-lets-repository-writers.html