Gitea Patches Critical RCE Flaw Allowing Repository Writers to Plant Git Hooks
Gitea has fixed a critical remote code execution vulnerability (CVE-2026-60004) that allowed users with repository write access to execute arbitrary shell commands by exploiting how patch content is processed.
Gitea, the popular self-hosted Git platform, has addressed a critical remote code execution (RCE) vulnerability that allowed authenticated users with repository write permissions to execute arbitrary shell commands on the server. The flaw, tracked as CVE-2026-60004 and assigned a severe CVSS score of 9.8, affects Gitea versions 1.17 through 1.27 prior to version 1.27.1.
The vulnerability arises from the way Gitea processes patch content when using the /api/v1/repos/{owner}/{repo}/diffpatch endpoint. By submitting the same patch twice, an attacker can create an add/add collision. When combined with Git's three-way fallback option (enabled when Git version 2.32 or later is used), this checkout process can lead to the execution of a planted Git hook. Specifically, an executable file placed in the hooks/post-index-change directory within a bare temporary clone becomes active and is run by Git during index updates.
While the vulnerable API endpoint requires authentication and repository write access, Gitea's default configuration often lowers this barrier. By default, Gitea allows open registration without requiring email verification or manual approval, and new users are not restricted. This means an external attacker could create a normal account, establish a repository, and then exploit the vulnerability without needing pre-existing credentials or elevated privileges.
The successful exploitation of this flaw grants an attacker the same privileges as the Gitea operating-system account. Depending on the server's isolation and configuration, this could lead to the exposure of sensitive application and environment secrets, access to mounted repositories, database credentials and data, OAuth credentials, and potentially allow attackers to pivot to internal services.
Security researcher Shai Rod, known as NightRang3r, discovered and reported the vulnerability. Gitea has released version 1.27.1 to address the issue. For Gitea Cloud instances, automatic upgrades have been implemented. While the advisory does not indicate that the vulnerability has been exploited in the wild, proof-of-concept (PoC) code has been made public, increasing the risk of exploitation.
As a mitigation measure while deploying the update, administrators can disable open registration to prevent new external accounts from being created. However, this measure does not fix the underlying flaw or protect against existing users who already possess repository write access. The fix in version 1.27.1 involves changing the temporary clone from a bare repository to a non-bare one, with code comments explicitly warning about potential interactions with the working tree when using Git commands with the --index flag.
It is noteworthy that the fix for this critical vulnerability was not prominently highlighted in the release notes for version 1.27.1. It was listed under 'MISC' as 'refactor: git patch apply,' rather than under a dedicated security section. This could potentially lead to administrators overlooking the importance of the update. The vulnerability was also disclosed alongside a separate file-inclusion issue, also fixed in 1.27.1, which allowed attackers to read server files like /etc/passwd.