Gitea Code Injection via diffpatch API (CVE-2026-60004)

Catalog analysis: CISA added this entry on August 25, 2026. The entry reflects catalog information retrieved on September 01, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-60004 is a code injection vulnerability (CWE-94) affecting Gitea. The flaw exists within the diffpatch API endpoint. An attacker who possesses write access to a repository can send a malicious patch to this endpoint, enabling them to plant an executable Git hook. This allows for the execution of arbitrary shell commands with the privileges of the Gitea service account.

Exposure and applicability

This vulnerability is applicable to Gitea instances where the diffpatch API is accessible and users have been granted repository write permissions. The risk is not universal to all users but is specific to those with sufficient authorization to modify repositories. Because this flaw allows for command execution at the service account level, it represents a significant escalation of privilege from a standard collaborator to the system user running the Gitea process.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities catalog, remediation should be prioritized. Our analysis suggests the following sequence:

1. Immediate Patching: Apply vendor-supplied mitigations and updates to close the injection vector in the diffpatch API.
2. Forensic Triage: Because this vulnerability allows for the planting of executable hooks, patching alone does not remove existing compromises. Defenders must perform forensic triage to identify if malicious Git hooks have already been planted on the filesystem.
3. Permission Audit: Review repository write access across the environment to ensure the principle of least privilege is applied, reducing the number of accounts capable of interacting with the vulnerable API endpoint.

How to validate remediation

Verification must go beyond confirming a version number. To assure that exposure has been reduced, defenders should:

• Verify Patch Application: Confirm the updated binaries are deployed and the service has been restarted.
• Audit Git Hooks: Inspect the server-side filesystem for unauthorized or unexpected executable files within the Git hooks directories of hosted repositories. This is the primary evidence that a compromise did not occur prior to patching.
• API Testing: In a staged environment, attempt to send a patch to the diffpatch endpoint using an account with write access to verify that the injection vector is no longer viable.

Limits and open questions

While the mechanism of the vulnerability is identified, it remains unknown whether this flaw has been utilized by ransomware campaigns. Furthermore, while patching prevents new injections, there is a residual risk if forensic triage is skipped, as previously planted hooks may remain active. The effectiveness of the remediation depends entirely on the thoroughness of the filesystem audit to ensure no persistence was established before the update.

Source and editorial note

CVE-2026-60004: Gitea Code Injection Vulnerability · Source date: August 25, 2026 · Retrieved September 01, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment