New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Summary: Gitea patched a critical remote code execution flaw, CVE-2026-60004 with a CVSS score of 9.8, affecting versions 1.17 and later before 1.27.1 and fixed in 1.27.1. A user with ordinary repository write access can submit the same patch twice to the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, creating an add/add collision that lands an executable file at hooks/post-index-change in a bare temporary clone and runs shell commands as the Gitea service account.
What's compelling: Gitea enables registration by default with no email or manual approval, so an outside visitor can create a normal account and repository on an unchanged installation and exploit the bug without pre-existing credentials. The fix shipped under MISC in the release notes as "refactor: git patch apply," not under SECURITY, so an administrator scanning the changelog for security entries could miss it entirely.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-60004
- Related
- CVE-2026-60004: Gitea Code Injection Vulnerability Known Exploited Vulnerabilities · Aug 25, 2026