{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/forgejo-1.17---1.27.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gitea (1.17 - 1.27.0)","Forgejo (1.17 - 1.27.0)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","git","vulnerability","gitea","forgejo"],"_cs_type":"advisory","_cs_vendors":["Gitea","Forgejo"],"content_html":"\u003cp\u003eCVE-2026-60004 is a critical-severity (CVSS 9.8) pre-authentication remote code execution vulnerability impacting Gitea and Forgejo self-hosted platforms, specifically versions 1.17 through 1.27.0. The vulnerability stems from a design flaw in the \u003ccode\u003ePOST /api/v1/repos/{owner}/{repo}/diffpatch\u003c/code\u003e API endpoint. During a diffpatch operation, the platform performs a bare temporary clone where the repository root coincides with \u003ccode\u003e$GIT_DIR\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAn attacker can leverage default open registration settings to create an account and obtain repository write access. By submitting a specially crafted patch twice, the attacker triggers an add/add conflict. Git's three-way merge fallback (\u003ccode\u003e-3\u003c/code\u003e) incorrectly writes the resulting merged file, which contains an attacker-supplied \u003ccode\u003epost-index-change\u003c/code\u003e Git hook, directly into the \u003ccode\u003e$GIT_DIR/hooks/\u003c/code\u003e directory. Git automatically executes this hook upon index updates, granting the attacker arbitrary code execution under the context of the Gitea service account. The exploit was publicly released on Sploitus on August 3, 2026.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates an account on a target instance, utilizing default open registration settings.\u003c/li\u003e\n\u003cli\u003eAttacker initializes a private repository to obtain the required write access.\u003c/li\u003e\n\u003cli\u003eAttacker sends a POST request to \u003ccode\u003e/api/v1/repos/{owner}/{repo}/diffpatch\u003c/code\u003e with a patch targeting \u003ccode\u003ehooks/post-index-change\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server creates a bare temporary clone, placing the hook path directly into \u003ccode\u003e$GIT_DIR/hooks/\u003c/code\u003e due to the bare repository root design.\u003c/li\u003e\n\u003cli\u003eAttacker sends the identical patch a second time, triggering an add/add conflict in the Git process.\u003c/li\u003e\n\u003cli\u003eGit's three-way merge fallback (\u003ccode\u003e-3\u003c/code\u003e) resolves the conflict by writing the malicious hook file to disk.\u003c/li\u003e\n\u003cli\u003eThe system updates the Git index, causing Git to unconditionally execute the now-executable \u003ccode\u003epost-index-change\u003c/code\u003e hook.\u003c/li\u003e\n\u003cli\u003eThe hook executes the attacker's payload (e.g., reverse shell or output exfiltration via \u003ccode\u003ecurl\u003c/code\u003e) under the Gitea service account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an unauthenticated attacker full command execution on the host server. Given the nature of Gitea/Forgejo deployments, this often leads to total infrastructure compromise, data exfiltration from private repositories, and potential lateral movement into the hosting environment. Exploits are actively circulating in public repositories as of August 2026.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all Gitea and Forgejo instances to version 1.27.1 or higher immediately to apply the fix for CVE-2026-60004.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule provided below to monitor for suspicious patterns of \u003ccode\u003ediffpatch\u003c/code\u003e API usage combined with account creation.\u003c/li\u003e\n\u003cli\u003eDisable public registration on internet-facing Gitea/Forgejo instances if not strictly required to mitigate initial access.\u003c/li\u003e\n\u003cli\u003ePerform forensic analysis on the host file systems for unexpected files located in \u003ccode\u003ehooks/\u003c/code\u003e directories of repository paths, specifically searching for \u003ccode\u003epost-index-change\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eReview web server logs for high volumes of \u003ccode\u003ediffpatch\u003c/code\u003e POST requests originating from new user accounts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-03T14:08:33Z","date_published":"2026-08-03T14:08:33Z","id":"https://feed.craftedsignal.io/briefs/2026-08-cve-2026-60004-gitea-rce/","summary":"CVE-2026-60004 is a critical pre-authentication RCE vulnerability in Gitea and Forgejo platforms caused by an unsafe bare clone design in the diffpatch API endpoint, enabling arbitrary command execution via injected Git hooks.","title":"Critical Pre-Authentication RCE in Gitea and Forgejo","url":"https://feed.craftedsignal.io/briefs/2026-08-cve-2026-60004-gitea-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Forgejo (1.17 - 1.27.0)","version":"https://jsonfeed.org/version/1.1"}