---
id: 8833
title: "CVE-2026-60004: Gitea diffpatch Git Hook Installation Remote Code Execution Exploit PoC"
cve: CVE-2026-60004
cvss: 9.8
severity: critical
vendor: "Gitea"
product: "Gitea"
affected_versions: ">= 1.17, < 1.27.1"
source_domain: github.com
source_url: "https://github.com/HORKimhab/CVE-2026-60004"
published_at: "2026-07-29T08:45:51Z"
tags: ["rce", "gitea", "red-team", "exploitation", "poc", "cve-2026-60004", "git-hooks"]
phying_url: "https://phying.com/item/8833"
lang: en
---

# CVE-2026-60004: Gitea diffpatch Git Hook Installation Remote Code Execution Exploit PoC

## Summary

A PoC for CVE-2026-60004, a critical RCE in Gitea (<1.27.1). It abuses the diffpatch endpoint to plant a malicious Git hook, giving command execution as the Gitea service account.

## Why it matters

When self-registration is enabled, any unauthenticated attacker can create an account and immediately achieve host-level remote code execution on self-hosted Gitea instances.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-60004
- **CVSS:** 9.8
- **Vendor:** Gitea
- **Product:** Gitea
- **Affected versions:** >= 1.17, < 1.27.1
- **Published:** 2026-07-29T08:45:51Z
- **Original:** https://github.com/HORKimhab/CVE-2026-60004
- **Phying News:** https://phying.com/item/8833