CVE-2026-60004: Gitea diffpatch API code injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a CVSS score of 9.8, KEV listing and very high EPSS probability.

What it is

Gitea before 1.27.1 allows remote code execution through the diffpatch API by way of Git hook installation. The flaw is a code injection issue (CWE-94) that lets an unauthenticated network attacker run code on the server, which matters because Gitea instances are often internet-facing and hold source code and CI credentials.

Impact

An attacker gains arbitrary code execution on the Gitea host, with high impact to confidentiality, integrity and availability. That can lead to theft of repositories, tokens and secrets, or full compromise of the server.

Attack surface

Reached over the network through the diffpatch API; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required. Any Gitea instance exposing the API is potentially reachable.

Exploitation

CVE-2026-60004 is listed in CISA KEV with a due date of 2026-08-28, and EPSS gives a 30-day probability of 0.86777 (99.7th percentile). Public exploit and mitigation references exist, and KEV does not record ransomware campaign use.

What to do

• Upgrade Gitea to 1.27.1 or later, following the vendor release notes and security advisory.
• If patching cannot be done immediately, restrict or disable access to the diffpatch API and limit Git hook installation paths per vendor guidance.
• Remove internet exposure of the Gitea web/API interface where feasible, placing it behind authentication and network controls.
• Apply CISA BOD 26-04 required actions, including the stated forensics triage requirements, and discontinue use of the product if mitigations are unavailable.
• Audit repository and server-side Git hooks for unauthorized additions or modifications.

Detection

• Review Gitea and reverse-proxy logs for anomalous requests to the diffpatch API endpoint, especially from unexpected source addresses.
• Monitor filesystem changes to Git hook directories and Gitea configuration for newly created or altered hook scripts.
• Alert on unexpected child processes spawned by the Gitea service account, such as shells or interpreters.
• Check for outbound connections or credential access from the Gitea host that do not match normal operation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.