CVE-2026-60004: Gitea RCE Through diffpatch API

CVE-2026-60004 is a remote code execution (RCE) vulnerability affecting Gitea versions before 1.27.1. The flaw lies in the diffpatch API and is exploitable through Git hook installation, allowing a remote attacker to execute arbitrary code on affected Gitea servers. The impact directly affects Gitea system administrators, repository managers, and DevOps infrastructures using this versioning solution.

The vulnerability has a CVSS score of 9.8, classified as critical by the National Vulnerability Database. The CVE was published on August 26, 2026. A GitHub signal dated November 1, 2026 (today) indicates the presence of public repositories claiming to contain exploit material related to this flaw, confirming a state of public exposure. No reports of active exploitation have been recorded, but the risk is elevated given the availability of exploits.

Gitea administrators must update immediately to version 1.27.1 or later. Verify your Gitea system inventory and installed versions without delay. If updates are delayed, monitor access to the diffpatch API and implement network restrictions to limit interface exposure to authorized clients only. Review logs for any suspicious access to the diffpatch API and Git hook management.