your newest Gitea contributor might already have a shell on your server

A patch, a diff, and a Git hook was all it took — no admin access required, and Gitea's own advisory shipped with working exploit code attached. Aliteq Priya Nair · Software & Systems Editor

CVE-2026-60004 affects Gitea 1.17 through 1.27.0, fixed in 1.27.1 released July 27, 2026.

What you need to know

CVSS 9.8: an attacker only needs standard repository write access, which Gitea grants to any account it lets self-register by default.

What you need to know

The bug lives in the /diffpatch API endpoint — submitting the same malicious patch twice tricks Git's three-way merge into checking out a file at hooks/post-index-change, which becomes a live hook.

What you need to know

Gitea's own July 28 advisory shipped with working proof-of-concept code, so exploitation is trivial for anyone who reads it. Patch before you finish this article.

What you need to know

A 9.8 that only needs the access level Gitea grants to a stranger who signed up thirty seconds ago is about as bad as self-hosted RCE gets. If your instance has been running since before July 27…

Publishing working exploit code the same day as the advisory shortens the window between disclosure and real-world attacks against unpatched instances to roughly zero. My honest take: any team still…

Patch before you read the PoC

Read the full story

Aliteq your newest Gitea contributor might already have a shell on your server Read the full story on Aliteq