Description
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Gitea | Gitea | 1.17 – < 1.27.1 | 1.27.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | openSUSE-SU-2026:21897-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | forgejo | 15.0.6-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitea | 1.27.1-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 12 repositories · most starred shown
-
imbas007/CVE-2026-60004-POC ★ 17 · Aug 3, 2026
CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)
-
ashrafzaryouh/CVE-2026-60004 ★ 6 · Jul 30, 2026
CVE-2026-60004
-
HORKimhab/CVE-2026-60004 ★ 5 · Jul 29, 2026
CVE-2026-60004
-
gagaltotal/CVE-2026-60004-poc-gitea ★ 2 · Aug 8, 2026
CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection
-
HackSpeak/CVE-2026-60004 ★ 2 · Aug 4, 2026
Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account
-
yym8538/CVE-2026-60004 ★ 1 · Aug 21, 2026
-
EQSTLab/CVE-2026-60004 ★ 1 · Jul 30, 2026
Gitea diffpatch RCE
-
fevar54/cve-2026-60004 ★ 0 · Aug 25, 2026
CVE-2026-60004 es una vulnerabilidad crítica (CVSS 9.8) en Gitea que permite ejecución remota de código sin autenticación mediante el endpoint `/api/v1/repos/{owner}/{repo}/diffpatch`.
-
Sachinart/CVE-2026-60004-gitea-0day ★ 0 · Aug 4, 2026
CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE
-
shinthink/CVE-2026-60004 ★ 0 · Aug 3, 2026
CVE-2026-60004 — Gitea/Forgejo Diffpatch Git Hook RCE. Bare clone → post-index-change hook injection. CVSS 9.8 | CWE-94 | Gitea < 1.27.1
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Gitea <= 1.27.0 - Pre-Auth Remote Code Execution http/cves/2026/CVE-2026-60004.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | code.gitea.io/gitea | >= 1.17.0 | — | GO-2026-6433 |
| Go | gitea.dev | >= 1.17.0, < 1.27.1 | 1.27.1 | GHSA-rcr6-4jqh-j84m |
| Go | gitea.dev | < 1.27.1 | 1.27.1 | GO-2026-6433 |
Advisories 4
- SUSE-SU-2026:23863-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 27, 2026
- SUSE-SU-2026:23855-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 27, 2026
- openSUSE-SU-2026:21897-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 25, 2026
- WID-SEC-2026-2557 Gitea: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Aug 26, 2026