CVE-2026-60004: Gitea Code Injection Vulnerability
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Overview
Gitea versions 1.17.0 through 1.27.0 contain a code injection flaw in the diffpatch API endpoint that allows an attacker with repository write access to plant an executable Git hook and run arbitrary shell commands as the Gitea service account. On instances with open registration enabled, any unauthenticated visitor can obtain the required write access by registering an account and creating a repository, making the attack path effectively unauthenticated. Successful exploitation exposes application secrets, database credentials, mounted repositories, and any internal services reachable from the Gitea OS user.
Vulnerability details
The diffpatch endpoint in services/repository/files/patch.go applies attacker-controlled patches to a shared bare temporary clone using git apply. In a bare clone, the repository root is $GIT_DIR. Submitting the same patch twice creates an add/add collision; Git's three-way merge fallback, activated by the -3 flag available in Git 2.32 and later, writes the patch content to a path under $GIT_DIR even though the operation uses --cached. An entry placed at the correct path under $GIT_DIR becomes a live, executable Git hook that Git invokes during index operations.
An attacker submits a crafted patch twice to the diffpatch API. The patch encodes an executable Git hook containing arbitrary shell commands. When Git processes the resulting add/add collision and invokes the hook, those commands execute as the Gitea service account. The attacker then retrieves output by fetching a result branch created by the hook, requiring no outbound connection from the server. On instances with open registration, no prior credentials are needed: the attacker registers an account, creates a repository, and submits the malicious patch sequence.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review Gitea application logs for repeated POST requests to the diffpatch API endpoint from the same account or IP within a short window, particularly two identical patch submissions against the same repository, which is the specific trigger pattern this attack requires.
- Audit Git hook files appearing under Gitea's temporary bare clone directories (paths matching the Gitea tmp directory configured in app.ini) after diffpatch operations; any executable hook file written there outside of a normal repository push or admin action is anomalous.
- Check for new branches created immediately after diffpatch API calls on the same repository, especially branches with no corresponding pull-request or user-initiated push event, which the published proof-of-concept uses to exfiltrate command output.
Remediation
Additional hardening
- Upgrade Gitea to version 1.27.1 or later, which contains the fix for this vulnerability; instances running any version from 1.17.0 through 1.27.0 are affected and should be updated immediately.
- If immediate upgrade is not possible, restrict access to the diffpatch API endpoint at the network or reverse-proxy layer to trusted internal networks only, reducing exposure to unauthenticated or low-privilege attackers.
- Disable open registration (set DISABLE_REGISTRATION = true in app.ini) to eliminate the no-prior-credentials attack path; this forces write access to require an administrator-provisioned account.
- Mount Gitea's temporary directory (configured as TMP_PATH in app.ini) with the noexec flag to prevent planted hook files from executing, removing a required precondition for this attack even if a malicious patch is written.
Key dates
References
- https://github.com/0xBlackash/CVE-2026-60004
- https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-60004
- https://blog.gitea.com/release-of-1.27.1/
- https://www.runzero.com/blog/gitea/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004
Frequently asked questions
Does CVE-2026-60004 affect my FedRAMP authorization?
If Gitea runs inside your authorization boundary, CVE-2026-60004 affects your Federal Risk and Authorization Management Program (FedRAMP) authorization directly. CISA's Known Exploited Vulnerabilities (KEV) catalog lists this vulnerability with a remediation deadline of August 28, 2026. An unpatched KEV inside your boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it as a deficiency.
How does Knox help me handle CVE-2026-60004?
Knox does not patch your Gitea instance. Remediation is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. Applying the patch to Gitea is yours to execute; maintaining a defensible compliance posture while you do it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including a critical finding like CVE-2026-60004. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the lead time to act before a finding becomes a formal deficiency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-60004 isn't remediated by August 28, 2026?
Missing the August 28, 2026 deadline turns CVE-2026-60004 into a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what converts a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Remediating Gitea on time keeps your authorization clean and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
