CVE-2026-60004

Undergoing Analysis Undergoing Analysis - In Progress

Remote Code Execution in Gitea via Diffpatch API

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: MITRE

Description

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-60004

Affected Vendors & Products

Vendor	Product	Version / Range
go-gitea	gitea	to 1.27.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Gitea before version 1.27.1 has a vulnerability that allows remote attackers to execute arbitrary code on the server. This occurs through the diffpatch API, which is used for applying patches to repositories. The issue stems from improper handling during Git hook installation, enabling an attacker to inject malicious commands.

Detection Guidance

To detect this vulnerability, check Gitea versions before 1.27.1. Use commands like 'gitea --version' or inspect package managers (e.g., 'apt list --installed | grep gitea'). Monitor for unauthorized Git hook installations or unexpected API calls to the diffpatch endpoint.

Impact Analysis

If you are running a vulnerable version of Gitea, an attacker could exploit this to take full control of your Gitea server. This may lead to unauthorized access to repositories, data theft, or further compromise of connected systems. The high CVSS score indicates severe potential impact.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Upgrade Gitea to version 1.27.1 or later to address the remote code execution vulnerability in the diffpatch API.

Hi! I’m here to help you understand CVE-2026-60004. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70