CVE-2026-60004: Gitea diffpatch Git-Hook Remote Code Execution (KEV)

CVE-2026-60004 is a code-injection flaw in Gitea's diffpatch API that lets a repository-write user plant a malicious Git hook and run arbitrary shell commands as the Gitea service account, and on instances that allow open self-registration any new account can reach that same repository-write access.

CVE-2026-60004 is a Code Injection (CWE-94) vulnerability in Gitea, the self-hosted Git service. NVD's Analyzed description states plainly: "Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation" (NVD).

NVD's vulnStatus for this record is Analyzed, but NVD has not published its own independent Primary CVSS score; the only metric on record is MITRE's CNA-submitted Secondary rating of CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. So the 9.8 shown here is the CNA Secondary score, not an NVD-confirmed Primary score (NVD).

GitHub's companion advisory GHSA-rcr6-4jqh-j84m explains the exact exploitation chain: Gitea's diffpatch endpoint applies uploaded patches with git apply --cached inside a bare temporary repository; submitting the same patch twice triggers an add/add merge collision, and Git's three-way-merge fallback checks out the colliding path to disk even though --cached was requested. Because the working tree of a bare repository is its own $GIT_DIR, an attacker can make that checked-out file land at hooks/post-index-change — a Git hook that Git invokes automatically during index operations — giving the attacker arbitrary shell execution as the Gitea service account. The advisory notes the attacker needs repository write access to reach the diffpatch endpoint, but "registration-enabled instances allow unauthenticated users to gain necessary access by creating an account." Affected versions are 1.17 through 1.27.0, fixed in 1.27.1, and the advisory lists no workaround short of upgrading (GitHub Advisory GHSA-rcr6-4jqh-j84m).

CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-25, with a required-action due date of 2026-08-28, forensic-triage required under BOD 26-04, though the catalog does not record known ransomware campaign use. CISA's own short description matches the GHSA account: "an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account" (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.2399 (97.829th percentile) (FIRST EPSS).

Any Gitea instance on an affected version should be upgraded to 1.27.1 or later immediately; instances that cannot upgrade right away should disable open self-registration and audit which accounts hold repository write access, since either path reaches the vulnerable endpoint.

• Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — MITRE's CNA Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
• Exploit chain: duplicate diffpatch submissions trigger a Git add/add merge collision that writes an attacker-controlled hooks/post-index-change file, executed by Git as the Gitea service account; repository write access is required, but open self-registration lets any new account reach it. Affected 1.17-1.27.0, fixed in 1.27.1, no workaround. — GitHub Advisory GHSA-rcr6-4jqh-j84m
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-08-25, required-action due date 2026-08-28. — CISA KEV
• EPSS score is 0.2399 (97.829th percentile) as of 2026-10-27. — FIRST EPSS