---
id: 5560
title: "CVE-2026-60004: Gitea diffpatch remote code execution with public PoC"
cve: CVE-2026-60004
cvss: 9.8
severity: critical
vendor: "Gitea"
product: "Gitea"
affected_versions: "Gitea >= 1.17 and < 1.27.1"
source_domain: github.com
source_url: "https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m"
published_at: "2026-07-28T00:00:00Z"
tags: ["rce", "gitea", "git", "public-poc", "featured", "open-source", "advisory", "cve-2026-60004", "git-hook"]
phying_url: "https://phying.com/item/5560"
lang: en
---

# CVE-2026-60004: Gitea diffpatch remote code execution with public PoC

## Summary

Gitea's diffpatch endpoint can be abused by repository-controlled content to install and trigger a Git hook in a temporary bare clone, resulting in arbitrary command execution as the Gitea service account. Versions from 1.17 up to, but not including, 1.27.1 are affected. With open registration, a visitor can register an ordinary account and create the required repository. The official advisory includes a complete PoC; version 1.27.1 contains the fix.

## Why it matters

Successful exploitation may expose app.ini, process environment secrets, mounted repositories, database and OAuth or integration credentials, and other reachable services. Upgrade to Gitea 1.27.1 or later immediately. Until patched, restrict open registration and repository creation, and review temporary-filesystem and service-account permissions.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-60004
- **CVSS:** 9.8
- **Vendor:** Gitea
- **Product:** Gitea
- **Affected versions:** Gitea >= 1.17 and < 1.27.1
- **Published:** 2026-07-28T00:00:00Z
- **Original:** https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
- **Phying News:** https://phying.com/item/5560