CVE-2026-60004

Name of the Vulnerable Software and Affected Versions Gitea versions 1.17.0 through 1.27.0

Description A critical code injection issue exists in the diffpatch API endpoint. An attacker with write access to a repository can exploit this by submitting a specially crafted patch twice, triggering an add/add collision. When Gitea uses git apply -3 (available in Git 2.32 and newer) within a bare temporary clone, it performs a three-way merge that allows the attacker to write an executable file into the hooks/post-index-change directory. This file is then executed as the Gitea service account, leading to remote code execution (RCE).

If open user registration is enabled, unauthenticated attackers can register an account and create a repository to obtain the necessary write access. This flaw has been actively exploited in a multinational campaign by a threat actor known as Red Heron, who targeted organizations in Canada, Argentina, Taiwan, the United States, Sri Lanka, and Qatar. The campaign involved scanning over 1,800 instances and deploying the JITTERLY Linux implant and the SIXZUT LD PRELOAD rootkit to maintain persistence and steal source code and credentials.

Recommendations Update Gitea to version 1.27.1 or newer. Disable open user registration to prevent unauthorized account creation. Restrict public internet exposure of Gitea instances by using a VPN or proxy. As a temporary mitigation, restrict access to the diffpatch API endpoint.