CVE-2026-60004: Gitea diffpatch API lets repository writers plant Git hooks and run commands

Exploited in the wild Critical 9.8 EPSS 24.0% Gitea / Forgejo

Gitea 1.17 through 1.27.0 apply user-supplied patches in a temporary bare clone in a way that lets an attacker plant an executable Git hook (hooks/post-index-change) through the diffpatch API and run shell commands as the Gitea service account. Any user with write access to a repository can exploit it, and where open registration is enabled an unauthenticated visitor can simply sign up and create a repository first. Gitea fixed it in 1.27.1, released on July 27, 2026. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25 as exploited in the wild.

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

  1. Check whether you run Gitea / Forgejo and which version (commands below).
  2. Install the fixed version for your system: see “Patch it” below.
  3. Restart Gitea with the new binary or image. On startup Gitea runs any needed database migrations automatically, which can take a while on large instances.
  4. Because this flaw is being exploited, also check the server for signs of compromise.

Affected and fixed versions

Affected:

Fixed in:

Am I affected?

gitea --version
curl -s https://<your-gitea-host>/api/v1/version
docker exec gitea gitea --version

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian
not in distro repos: upstream binary
Ubuntu
not in distro repos: upstream binary
RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh forgejo (EPEL; Gitea: upstream binary)
Fedora
sudo dnf upgrade --refresh forgejo
SUSE / openSUSE
not in Leap 16: upstream binary
Amazon Linux
not packaged: upstream binary
Arch Linux
sudo pacman -Syu
Alpine
apk update && apk upgrade gitea forgejo (or forgejo-lts)
FreeBSD
pkg update && pkg upgrade gitea forgejo (or forgejo-lts)
Docker images
docker pull docker.gitea.com/gitea:1.27.1
# in docker-compose.yml set: image: docker.gitea.com/gitea:1.27.1
docker compose up -d
Built from source
# official binary install (docs.gitea.com); back up the data directory and database first
wget -O gitea https://dl.gitea.com/gitea/1.27.1/gitea-1.27.1-linux-amd64
chmod +x gitea
sudo systemctl stop gitea
sudo cp gitea /usr/local/bin/gitea
sudo systemctl start gitea

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

ReleasePackageStatusFixed version / advisory
Alpine Linux edge (community)giteafixed1.27.1-r0

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

Look for signs of exploitation

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60004

Related vulnerabilities

Sources

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.