CVE-2026-60004: Gitea diffpatch remote code execution with public PoC

Gitea's diffpatch endpoint can be abused by repository-controlled content to install and trigger a Git hook in a temporary bare clone, resulting in arbitrary command execution as the Gitea service account. Versions from 1.17 up to, but not including, 1.27.1 are affected. With open registration, a visitor can register an ordinary account and create the required repository. The official advisory includes a complete PoC; version 1.27.1 contains the fix.

Successful exploitation may expose app.ini, process environment secrets, mounted repositories, database and OAuth or integration credentials, and other reachable services. Upgrade to Gitea 1.27.1 or later immediately. Until patched, restrict open registration and repository creation, and review temporary-filesystem and service-account permissions.