← News
/DISPATCH · 2026-08-27

CVE-2026-60004: Gitea diffpatch Endpoint Git Hook RCE; PoC and Miner Malware Spreading In the Wild

CISA recently added a remote code execution vulnerability affecting the Gitea self-hosted Git platform to the Known Exploited Vulnerabilities catalog as CVE-2026-60004, CVSS 9.8 (Critical). The flaw sits in Gitea's diffpatc

CISA recently added a remote code execution vulnerability affecting the Gitea self-hosted Git platform to the Known Exploited Vulnerabilities catalog as CVE-2026-60004, CVSS 9.8 (Critical). The flaw sits in Gitea's diffpatch API endpoint. With repo write access, an attacker uses Git three-way merge fallback to drop an executable `hooks/post-index-change` Git Hook into Gitea's temp clone, then runs arbitrary shell as the Gitea service account. Gitea open registration is on by default; with public PoC scripts, internet-exposed self-hosted instances are being mass-converted into miner jump boxes.

Incident Overview

CVE: CVE-2026-60004, CWE-94 Improper Control of Generation of Code (Code Injection). CVSS v3.1 base: 9.8, AV:N, AC:L, PR:N, UI:N, Scope Unchanged. Disclosure: 8 Aug 2026; patch: 27 Jul 2026 (v1.27.1), security advisory same day. CISA KEV: yes; confirmed in-the-wild exploitation. Affected: Gitea 1.17 through 1.27.0, all branches. Fixed: Gitea 1.27.1 and later, all branches.

Technical Details

Gitea's `/api/v1/repos/{owner}/{repo}/diffpatch` endpoint accepts a user-submitted patch and runs `git apply --cached` against a temporary bare repo. That should update the index only and not write files to disk, but the code also implicitly appends `--index --recount --binary` besides `--cached`.

On Git ≥ 2.32, `git apply` falls back to three-way merge (`-3`) on add/add conflicts. Submit the same patch twice, trigger add/add, and three-way merge fallback ignores `--cached` and checks files out into the worktree. In a bare repo the worktree root is `$GIT_DIR` itself, so the attacker's `hooks/post-index-change` (mode 100755) is written as a live Git Hook. Next Git index write runs the hook — arbitrary shell.

Public PoC (e.g. GitHub `EQSTLab/CVE-2026-60004`) automates the full chain: scrape registration-page CSRF token → register a random account → Basic Auth login → create a private repo with initialized main → deliver a prebuilt Git Hook patch via `diffpatch` → repeat until three-way merge fires → pull command output back over authenticated Smart HTTP. Payload is typically a POSIX sh hook that runs `eval $(cat cmd.sh)` for a staged malicious command.

Impact Assessment

Successful exploit yields arbitrary command execution as the Gitea service account (default `git` user):

Observed in-the-wild use is mostly cryptocurrency mining: generic miner droppers that burn CPU until the host provider rate-limits. Mallory platform stats show 9 working public PoCs, so scripted scan-and-exploit cost is near zero.

Remediation

References