Attackers exploit Gitea code injection flaw to execute shell commands via API
Attackers are actively exploiting a code injection flaw in Gitea to run shell commands with service account privileges. This vulnerability requires repository write access to succeed. If you run Gitea, check your logs for suspicious diffpatch API activity and prioritize patching immediately. 馃毃
Summary
CISA has added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation. The flaw exists in Gitea and allows an attacker with write access to a repository to execute arbitrary shell commands.
The vulnerability is triggered through the diffpatch API endpoint. By sending a malicious patch, an attacker can plant an executable Git hook, which subsequently runs commands under the context of the Gitea service account.
Technical details
The vulnerability centers on how Gitea handles incoming patches via its API. An attacker who has been granted write access to a repository can target the diffpatch endpoint to inject malicious instructions.
Once the malicious patch is processed, it installs a Git hook within the repository structure. Because Git hooks are executed during specific repository actions, the attacker can achieve code execution as the Gitea service account. This level of access can lead to total control over the affected asset.
Exploitation status
This vulnerability is currently being exploited in the wild. CISA added it to the KEV catalog on August 25, 2026, after confirming active exploitation.
For Federal Civilian Executive Branch (FCEB) agencies, remediation is a priority under Binding Operational Directive 26-04. While the directive specifically targets federal agencies, the presence of the vulnerability in the KEV catalog indicates a high-risk situation for all Gitea users.
Defender guidance
Prioritize updating Gitea to a patched version immediately. Because this vulnerability requires repository write access, audit your user permissions and ensure that only trusted individuals have write capabilities to your repositories.
Monitor your Gitea logs for unusual activity involving the diffpatch API endpoint. Look for unexpected file creations or modifications within the .git/hooks directories of your repositories. If you suspect a system has been compromised, follow the guidelines established in BOD 26-04 to determine if a threat actor gained access prior to your patch application.
Sources
