CVE-2026-60004

Name of the Vulnerable Software and Affected Versions Gitea versions 1.17 through 1.27.0

Description A critical code injection flaw exists in the services/repository/files/patch.go file. An attacker with write access to a repository can exploit the diffpatch API endpoint to install a malicious executable Git hook, allowing the execution of arbitrary shell commands with the privileges of the Gitea operating-system user. If open user registration is enabled, unauthenticated external attackers can register an account, create a repository, and gain the necessary write permissions to trigger the exploit.

Real-world incidents have been documented where this issue was exploited to deploy cryptocurrency-mining payloads. In one observed attack, the exploit chain from account creation to the deployment of a crypto-mining dropper took approximately 11 seconds. The malicious activity involved identifying CPU-intensive processes, terminating competing miners, and downloading architecture-specific binaries.

Recommendations Update Gitea to version 1.27.1 or later. As a temporary workaround, disable or restrict access to the diffpatch API endpoint. Review and restrict open user registration and repository write permissions.