A severe security vulnerability has been uncovered in Gitea, labeled as CVE-2026-60004, which could enable attackers to run arbitrary shell commands on susceptible servers. This flaw impacts Gitea versions from 1.17 through 1.27.0 and has been patched in version 1.27.1.
Understanding the Vulnerability
The vulnerability is rooted in Gitea’s diffpatch endpoint, which manages repository patches via Git commands. Attackers with write access to a repository can exploit this mechanism to introduce a malicious Git hook within a temporary bare repository clone. By placing a specially crafted file at hooks/post-index-change, it becomes an active Git hook.
The attack is triggered by submitting the same malicious patch twice. Gitea processes this with the git apply command, using index-related options, thus enabling the execution of harmful code.
Technical Details and Risks
On Git version 2.32 and newer, a three-way merge fallback may occur when add/add collisions are detected. This process checks out the indexed path, despite the operation using the –cached option. In a bare Git repository, this presents a significant threat as the repository root is also the Git directory.
When a malicious executable is placed in hooks/post-index-change, it is executed as a live hook, allowing attacker-controlled commands to run under the operating system account hosting the Gitea service. This makes publicly accessible Gitea instances particularly vulnerable.
Mitigation and Recommendations
The vulnerability is classified under CWE-94, indicating Improper Control of Code Generation, and has a CVSS v3.1 score of 9.8, reflecting its critical nature. To mitigate this risk, administrators should upgrade Gitea to version 1.27.1 without delay.
Until the update is applied, it is advisable to disable or limit access to the diffpatch feature, restrict public registration, control repository write permissions, and review service account privileges. Monitoring Gitea and Git logs for unusual activities is also recommended.
Recent Gitea updates have included numerous security enhancements, underscoring the vital importance of timely software updates and proactive exposure management.
