Full Report
Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver. [...]
Analysis Summary
# Vulnerability: Remote Code Execution via Malicious Patches in Gitea
## CVE Details
- **CVE ID:** CVE-2026-60004
- **CVSS Score:** 9.8 (Critical) - *Score estimated based on impact; specific vendor/NVD rating pending finalization.*
- **CWE:** CWE-94 (Code Injection)
## Affected Systems
- **Products:** Gitea (Self-hosted Git service)
- **Versions:** All versions prior to v1.27.1
- **Configurations:**
- Systems with **self-registration enabled** (default setting) are at highest risk, as unauthenticated attackers can create accounts to gain the required write access.
- Any instance where the `diffpatch` API endpoint is accessible.
## Vulnerability Description
The flaw exists within Gitea's `diffpatch` API endpoint. An attacker with write access to a repository can abuse this endpoint to install and execute a Git hook from content controlled within the repository. Because Gitea processes these patches using the privileges of the underlying service account, this leads to arbitrary shell command execution (Remote Code Execution) in the context of the Gitea OS user.
## Exploitation
- **Status:** Exploited in the wild (Actively targeted by threat actors to deploy cryptocurrency miners).
- **Complexity:** Low (Exploitation is straightforward once write access is obtained).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to all hosted source code and environment variables).
- **Integrity:** High (Ability to modify source code, repository history, and system files).
- **Availability:** High (Ability to crash the service, delete repositories, or consume resources via cryptominers).
## Remediation
### Patches
- **Upgrade to Gitea v1.27.1** or later immediately.
- Official releases can be found at: hxxps[://]github[.]com/go-gitea/gitea/releases
### Workarounds
- **Disable Self-Registration:** If an immediate patch is not possible, disable public sign-ups in `app.ini` (`DISABLE_REGISTRATION = true`) to prevent unauthenticated attackers from gaining the necessary write permissions.
- **Restrict API Access:** Implement firewall rules or reverse proxy configurations to restrict access to the `/api/v1/repos/{owner}/{repo}/diffpatch` endpoint to trusted internal IPs only.
## Detection
- **Indicators of Compromise:**
- Presence of unauthorized Git hooks in repository directories on the server.
- Unexpected CPU spikes (indicating potential cryptocurrency mining).
- Logs showing unusual activity from newly registered accounts or calls to the `diffpatch` endpoint.
- **Detection methods and tools:**
- **CISA KEV Catalog:** This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog.
- **Shadowserver:** Organizations can check Shadowserver’s reporting to see if their public IPs have been flagged as vulnerable.
## References
- **Vendor Advisory:** [hxxps[://]github[.]com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m]
- **Gitea Release Notes:** [hxxps[://]blog[.]gitea[.]com/release-of-1.27.1/]
- **CISA KEV Catalog:** [hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog]
- **Shadowserver Statistics:** [hxxps[://]dashboard[.]shadowserver[.]org/statistics/combined/time-series/?tag=cve-2026-60004]