Critical Pre-Authentication RCE in Gitea and Forgejo

CVE-2026-60004 is a critical-severity (CVSS 9.8) pre-authentication remote code execution vulnerability impacting Gitea and Forgejo self-hosted platforms, specifically versions 1.17 through 1.27.0. The vulnerability stems from a design flaw in the POST /api/v1/repos/{owner}/{repo}/diffpatch API endpoint. During a diffpatch operation, the platform performs a bare temporary clone where the repository root coincides with $GIT_DIR.

An attacker can leverage default open registration settings to create an account and obtain repository write access. By submitting a specially crafted patch twice, the attacker triggers an add/add conflict. Git's three-way merge fallback (-3) incorrectly writes the resulting merged file, which contains an attacker-supplied post-index-change Git hook, directly into the $GIT_DIR/hooks/ directory. Git automatically executes this hook upon index updates, granting the attacker arbitrary code execution under the context of the Gitea service account. The exploit was publicly released on Sploitus on August 3, 2026.

Attack Chain

1. Attacker creates an account on a target instance, utilizing default open registration settings.
2. Attacker initializes a private repository to obtain the required write access.
3. Attacker sends a POST request to /api/v1/repos/{owner}/{repo}/diffpatch with a patch targeting hooks/post-index-change.
4. The server creates a bare temporary clone, placing the hook path directly into $GIT_DIR/hooks/ due to the bare repository root design.
5. Attacker sends the identical patch a second time, triggering an add/add conflict in the Git process.
6. Git's three-way merge fallback (-3) resolves the conflict by writing the malicious hook file to disk.
7. The system updates the Git index, causing Git to unconditionally execute the now-executable post-index-change hook.
8. The hook executes the attacker's payload (e.g., reverse shell or output exfiltration via curl) under the Gitea service account.

Impact

Successful exploitation grants an unauthenticated attacker full command execution on the host server. Given the nature of Gitea/Forgejo deployments, this often leads to total infrastructure compromise, data exfiltration from private repositories, and potential lateral movement into the hosting environment. Exploits are actively circulating in public repositories as of August 2026.

Recommendation

1. Upgrade all Gitea and Forgejo instances to version 1.27.1 or higher immediately to apply the fix for CVE-2026-60004.
2. Implement the Sigma rule provided below to monitor for suspicious patterns of diffpatch API usage combined with account creation.
3. Disable public registration on internet-facing Gitea/Forgejo instances if not strictly required to mitigate initial access.
4. Perform forensic analysis on the host file systems for unexpected files located in hooks/ directories of repository paths, specifically searching for post-index-change.
5. Review web server logs for high volumes of diffpatch POST requests originating from new user accounts.