CVE-2026-60004: Gitea Remote Code Execution via diffpatch Git Hook Installation
Summary
CVE-2026-60004: Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev. Affects code.gitea.io/gitea versions >= 1.17.0. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-60004 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Gitea is an open-source self-hosted Git service that provides a user-friendly interface for managing Git repositories. It offers features such as issue tracking, pull requests, and a built-in wiki. However, Gitea has a vulnerability that allows remote code execution due to improper handling of Git hook installations, specifically through the diffpatch functionality.
Vulnerability Detail
The vulnerability identified as CVE-2026-60004 arises from the way Gitea handles the installation of Git hooks related to diffpatch. This flaw allows an attacker to execute arbitrary code on the server by crafting a malicious diffpatch Git hook. If exploited, this could lead to unauthorized access, data breaches, or complete server compromise. The issue was introduced in version 1.17.0 of the affected packages.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the diffpatch Git hook functionality in your Gitea configuration until you are able to update to the patched version. This can be done by modifying the Gitea configuration file to prevent the execution of hooks.
Conclusion
In summary, CVE-2026-60004 is a critical vulnerability in Gitea that allows for remote code execution through diffpatch Git hook installations. It is essential to update to version 1.27.1 or later to mitigate this risk. If immediate updates are not feasible, disabling the affected functionality can serve as a temporary measure.
See every vulnerability recorded for code.gitea.io/gitea →
FAQ
CVE-2026-60004 is a vulnerability in Gitea that allows for remote code execution through improper handling of diffpatch Git hook installations.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and potentially complete control over the server running Gitea.
Yes, a patch is available in Gitea version 1.27.1 and later. It is recommended to update to this version to mitigate the risk.
If you cannot update immediately, consider disabling the diffpatch Git hook functionality as a temporary workaround until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for code.gitea.io/gitea.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
