A PoC for CVE-2026-60004, a critical RCE in Gitea (<1.27.1). It abuses the diffpatch endpoint to plant a malicious Git hook, giving command execution as the Gitea service account.
Why it matters: When self-registration is enabled, any unauthenticated attacker can create an account and immediately achieve host-level remote code execution on self-hosted Gitea instances.
Gitea's diffpatch endpoint can be abused by repository-controlled content to install and trigger a Git hook in a temporary bare clone, resulting in arbitrary command execution as the Gitea service account. Versions from 1.17 up to, but not including, 1.27.1 are affected. With open registration, a visitor can register an ordinary account and create the required repository. The official advisory includes a complete PoC; version 1.27.1 contains the fix.
Why it matters: Successful exploitation may expose app.ini, process environment secrets, mounted repositories, database and OAuth or integration credentials, and other reachable services. Upgrade to Gitea 1.27.1 or later immediately. Until patched, restrict open registration and repository creation, and review temporary-filesystem and service-account permissions.
Skip to content