[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQH_2xRjfsXrrMNx4TDVAFFUR1wBTNgCkhm9MaqQHtJw":3,"$fIe9lzEtdOAhKiJCblR-lmEPtzDxcSF0rN4DNiIrGxlY":71},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":68,"created_at":69,"updated_at":70,"published_at":49},"gitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di","Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch","CVSS 9.8 flaw in Gitea's diffpatch API lets attackers write malicious Git hooks to run arbitrary commands as the Gitea process user on default installs with open self-registration.","Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.",[10,11,12,13,14,15],"Gitea","CVE-2026-60004","RCE","diffpatch","Git hooks","CVSS 9.8","# Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch\n\n*CVSS 9.8 flaw in Gitea's diffpatch API lets attackers write malicious Git hooks to run arbitrary commands as the Gitea process user on default installs with open self-registration.*\n\n**Tags:** `Gitea` `CVE-2026-60004` `RCE` `diffpatch` `Git hooks` `CVSS 9.8`\n\n> Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-60004 | 9.8 | 86.8% | ✅ listed | — | 89.78 (Critical) |\n\n## Gitea RCE: Unauthenticated Attackers Run Shell Commands as the Git User\n\nGitea has disclosed a critical remote code execution vulnerability in its diffpatch API endpoint, tracked as CVE-2026-60004 and rated CVSS 9.8 (v3.1) with an EPSS score of 86.8% at the 100th percentile. The flaw allows an attacker with repository write access to plant an executable Git hook from repository-controlled content, then run arbitrary shell commands as the Gitea process user.\n\nOn default installations where open self-registration is enabled, an unauthenticated attacker can register an account, create a repository, and push malicious content to trigger the hook. Successful exploitation executes commands with the privileges of the Gitea service account, exposing the main configuration file, application and process-environment secrets, database credentials, and OAuth and integration credentials.\n\nGitea released version 1.27.1 on July 27, 2026 to fix the issue. CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 25, 2026, ordering federal agencies to patch by August 28.\n\n## How the diffpatch Endpoint Turns a Patch into a Git Hook\n\nThe flaw lives in Gitea's diffpatch API endpoint, which applies user-supplied patches inside a temporary Git repository. In vulnerable releases, Gitea creates that temp clone as a bare repository, meaning the repository directory itself is Git's internal data directory. An attacker with write access manipulates the clone process so that repository-controlled content is materialized as an executable `post-index-change` hook rather than an ordinary file. Git then executes that hook during subsequent repository operations, running the attacker's shell commands as the OS user running the Gitea process.\n\nThe fix in version 1.27.1 changes the temporary clone from a bare repository to a non-bare one. That single change prevents the hook from being materialized as a `post-index-change` hook, since the repository directory is no longer Git's internal data directory in the same way. The patch was released on July 27, 2026, and affects Gitea 1.17 through 1.27.0.\n\n## Active Exploitation: Crypto-Miner Drops on Self-Hosted Gitea\n\nA Russian full-stack developer, Andrey (@Causelof), reported on Habr that his self-hosted Gitea instance was compromised via CVE-2026-60004 after his VPS host, HOSTKEY, flagged the server for running above 70% CPU for an extended period. The instance ran an outdated Gitea build with open self-registration enabled and no email confirmation or CAPTCHA, leaving the RCE path open to unauthenticated visitors.\n\nThe observed attack chain executes as the `git` user inside the Gitea process. The attacker first writes a proof-of-RCE payload back into a Git branch, then downloads a universal shell-loader followed by a crypto-miner-like dropper. On the compromised host, the miner competed for CPU against other malware already present, consistent with the sustained high utilization HOSTKEY reported.\n\n## 8,300+ Internet-Exposed Gitea Servers Still Unpatched\n\nShadowserver reports 8,300+ internet-exposed Gitea instances remain unpatched against CVE-2026-60004, up from roughly 5,000 cited days earlier. The count reflects confirmed-unpatched servers; there is no visibility into how many are honeypots or already secured.\n\nGitea has 400,000+ installations worldwide, making the exposed footprint a meaningful supply chain risk for self-hosted Git deployments.\n\n## Remediation: Upgrade to 1.27.1 and Disable Self-Registration\n\nUpgrade to Gitea 1.27.1 or later is the only fix for CVE-2026-60004. The patch, released July 27, 2026, changes the temporary clone from a bare repository to a non-bare one, preventing the `post-index-change` hook from being materialized from repository-controlled content.\n\nIf open sign-up isn't required, disable self-registration by setting `DISABLE_REGISTRATION = true` in `app.ini`. This closes the lowest-effort path to exploitation, where an unauthenticated visitor registers an account and creates a repository to gain the write access needed for the diffpatch endpoint.\n\nRestrict internet exposure of self-hosted Gitea instances. A related CVE-2026-59774, disclosed around the same time, allows unauthenticated attackers to enable servers and potentially chain into RCE, compounding the risk for organizations still running unpatched deployments.\n\n## Key points\n\n- CVE-2026-60004 is a critical RCE in Gitea's diffpatch API endpoint, rated CVSS 9.8 (3.1) with EPSS 86.8% (100th percentile).\n- Unauthenticated remote attackers can write malicious Git hooks via the diffpatch endpoint to execute arbitrary shell commands as the Gitea process user on default installs with open self-registration.\n- Affected versions are Gitea before 1.27.1; the fix changes the temporary clone from a bare to a non-bare Git repository to prevent hook materialization.\n- CISA added the CVE to its KEV catalog on August 25, 2026, ordering federal agencies to patch by August 28, 2026.\n- Shadowserver reports over 8,300 internet-exposed Gitea instances remain unpatched, with active exploitation deploying crypto-miner payloads as the git user.\n\n## Further reading & sources\n\n- [Gitea vulnerability CVE-2026-60004: find impacted assets](https:\u002F\u002Fwww.runzero.com\u002Fblog\u002Fgitea) — RunZero\n- [Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004) - Help Net Security](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F08\u002F26\u002Fgitea-cve-2026-60004-exploited-in-the-wild)\n- [Over 8,300 Gitea Servers Still Vulnerable to Active Code Execution Attacks | CosmicBytez Labs](https:\u002F\u002Flabs.cosmicbytez.ca\u002Fnews\u002F2026-08-28-over-8300-gitea-servers-vulnerable-to-code-execution-attacks)\n- [CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner-Like Payloads | SOC Prime](https:\u002F\u002Fsocprime.com\u002Fblog\u002Fcve-2026-60004-critical-gitea-rce-exploited-to-deploy-miner-like-payloads)\n- [Hackers target Gitea servers with critical code injection flaw](https:\u002F\u002Fwww.computing.co.uk\u002Fnews\u002F2026\u002Fsecurity\u002Fhackers-target-gitea-servers)\n- [Hackers now exploit critical Gitea flaw in code injection attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-now-exploit-critical-gitea-flaw-in-code-injection-attacks\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgitea-rce-cve-2026-60004-unauthenticated-attackers-execute-shell-commands-via-di.png?v=b4d72a9b81",{"cves":19,"malware":35,"targets":44,"timeline":52,"industries":61,"technologies":66},[20,29],{"id":21,"kev":22,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2026-59774",false,"\u002Fvulnerabilities\u002FCVE-2026-59774",9.8,0.2831,"Medium",55.79,"3.1",{"id":11,"kev":30,"poc":22,"url":31,"cvss":24,"epss":32,"risk_band":33,"risk_score":34,"cvss_version":28},true,"\u002Fvulnerabilities\u002FCVE-2026-60004",0.2399,"Critical",89.63,[36,38,40,42],{"name":37},"Dropper",{"name":39},"shell-loader",{"name":41},"crypto-miner",{"name":43},"crypto-miner-like dropper",[45,50],{"name":46,"sector":47,"status":48,"geography":49},"HOSTKEY","hosting","confirmed",null,{"name":10,"sector":51,"status":48,"geography":49},"DevOps",[53,57],{"date":54,"event":55,"description":56},"2026-07-27","Patch release","Gitea released version 1.27.1",{"date":58,"event":59,"description":60},"2026-08-26","CISA KEV addition","CISA added CVE-2026-60004 to KEV catalog",[62],{"url":63,"name":64,"slug":65},"\u002Findustries\u002Fcloud-hosting","Cloud & Hosting","cloud-hosting",[67],{"vendor":10,"product":10},"vulnerability_disclosure","2026-09-12T12:07:21.883073+00:00","2026-10-16T12:28:42.390191+00:00",{"articles":72},[73,84,96,107],{"slug":74,"title":75,"summary":76,"tags":77,"hero_image_url":82,"story_type":68,"created_at":83},"cisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline","CISA KEV adds N-Able N-Central RCE with 3-day federal deadline","CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog for N-able N-central, an unauthenticated authentication bypass that grants remote administrative access on versions through 2026.1, with a 3-day federal deadline and active in-the-wild exploitation.",[78,79,80,12,81],"CVE-2026-18556","N-Able N-Central","CISA KEV","authentication bypass","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcisa-kev-adds-n-able-n-central-rce-with-3-day-federal-deadline.png?v=584a02fe66","2026-09-21T12:03:34.769619+00:00",{"slug":85,"title":86,"summary":87,"tags":88,"hero_image_url":94,"story_type":68,"created_at":95},"jetbrains-teamcity-rce-cve-2026-63077-exposed-via-runzero-asset-discovery","JetBrains TeamCity RCE (CVE-2026-63077) Exposed via RunZero Asset Discovery","JetBrains TeamCity On-Premises before 2023.05.4 has an authentication bypass (CWE-288) that lets an unauthenticated remote attacker execute arbitrary code on the server, enabling supply-chain compromise of CI\u002FCD builds.",[89,90,91,12,92,93],"JetBrains","TeamCity","CVE-2023-42793","CI\u002FCD","RunZero","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fjetbrains-teamcity-rce-cve-2026-63077-exposed-via-runzero-asset-discovery.png?v=e72ab95e44","2026-09-12T07:13:03.260727+00:00",{"slug":97,"title":98,"summary":99,"tags":100,"hero_image_url":104,"story_type":105,"created_at":106},"274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570","274 Zimbra Servers Compromised in the Wild via CVE-2026-73570","Shadowserver found 274 internet-facing Zimbra Collaboration Suite servers compromised in-the-wild via CVE-2026-73570, an unauthenticated OS command injection in the zimbra-snmp package that lets attackers execute arbitrary commands as the zimbra user via crafted SMTP requests.",[101,102,12,80,103],"Zimbra","CVE-2026-73570","Shadowserver","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002F274-zimbra-servers-compromised-in-the-wild-via-cve-2026-73570.png?v=9273e873d2","exploitation","2026-09-24T07:12:41.74195+00:00",{"slug":108,"title":109,"summary":110,"tags":111,"hero_image_url":117,"story_type":118,"created_at":119},"greynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-","GreyNoise Labs reveals 34k+ sessions scanning Ivanti Connect Secure for CVE-2025-0282","Two parallel reconnaissance campaigns are scanning internet-facing Ivanti Connect Secure instances for CVE-2025-0282, with the high-volume cluster concentrated in AS213790 (Limited Network LTD) and the second campaign distributed across ~6,000 unique IPs.",[112,113,114,115,116,12],"Ivanti Connect Secure","CVE-2025-0282","GreyNoise Labs","AS213790","Limited Network LTD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgreynoise-labs-reveals-34k-sessions-scanning-ivanti-connect-secure-for-cve-2025-.png?v=ea7577722f","campaign","2026-09-14T07:09:53.792428+00:00"]