CVE-2026-60004

CVE-2026-60004 — Gitea Diffpatch Git Hook RCE Bare Clone Hook Injection → post-index-change → Arbitrary Command Execution Overview CVE-2026-60004 is a critical-severity CVSS 9.8 pre-authentication remote code execution vulnerability in Gitea and Forgejo self-hosted Git platforms, affecting versio...

GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...