External risk intelligence

Gitea Diffpatch API Remote Code Execution

CVE advisoryKnown Exploit

CVE-2026-60004

Gitea is a self-hosted software development platform that is commonly deployed as an internet-facing web application to facilitate collaboration, repository management, and code hosting for distributed teams. Because it functions as a public-facing web service, the interface, including its API endpoints, is often reachable from the internet in standard deployment patterns.

Code Injection

Gitea

1.17.0 to before 1.27.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Gitea, a self-hosted software development platform, that could allow remote code execution. This issue stems from how the platform handles patches through its diffpatch API, potentially enabling unauthorized installation of Git hooks and execution of commands. The main concern at this time is confirming whether our Gitea instances are affected and assessing potential exposure.

Malicious patches can install hooks and run commands.
This could lead to unauthorized system access.
Confirm Gitea relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a malicious patch to the diffpatch API. This would allow them to install an executable Git hook, which can then be used to run shell commands with the privileges of the Gitea service account. The vulnerability allows for remote code execution.

Network access is required.
Malicious patch sent to diffpatch API.
Enables remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote code execution vulnerability in the diffpatch API could allow an unauthenticated attacker to install and execute Git hooks, potentially leading to the compromise of the Gitea service account and its associated systems. This occurs when a malicious patch is sent to the API.

Gitea service account and system access.
Via a malicious patch to the diffpatch API.
Unauthenticated remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this remote code execution vulnerability in Gitea. The first practical step is to locate all Gitea instances, determine their internet reachability and business criticality, and then identify the specific owner for each instance to plan remediation.

Identify Gitea instances and their owners.
Verify internet exposure and business criticality.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Gitea?

Gitea is an open-source, self-hosted platform used by teams to manage code repositories, track development tasks, and facilitate collaboration. It acts as a private alternative to platforms like GitHub, allowing organizations to maintain full control over their source code and development workflows on their own infrastructure.

What does CVE-2026-60004 mean for Gitea security?

This vulnerability falls under the CWE-94 weakness class, which refers to improper control of generation of code. Specifically, the diffpatch API in older versions of Gitea allows unauthorized parties to manipulate Git hooks. By injecting malicious code through a patch, an attacker can trick the system into executing arbitrary commands with the privileges of the Gitea service account.

How can an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted, malicious patch to the diffpatch API endpoint. This action does not require legitimate user authentication to succeed. However, this bug is specifically tied to the processing of patches via that API; normal, non-malicious use of the Gitea repository management features does not inherently trigger this command execution.

Is my Gitea instance at risk?

Gitea is often deployed as a web-facing service to allow distributed teams to collaborate, which increases the likelihood of reachability from the internet. According to Halo Surface Signal, because this platform is frequently exposed to public networks, instances are generally reachable by external actors. If your instance is accessible online, it is a primary target for this type of network-based attack.

What should I do if I run Gitea?

Your first step is to inventory all Gitea instances within your environment and confirm their specific software version. Once you have identified these assets, assess which are exposed to the internet. Coordinate with your infrastructure or application owners to apply the vendor-provided updates, as upgrading to version 1.27.1 or later is the necessary path to remove the vulnerable code path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.