← Back to Feed

New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands

CVE-2026-60004

July 29, 2026 · The Hacker News · Severity: CRITICAL

Gitea patched CVE-2026-60004 (CVSS 9.8), a critical remote code execution vulnerability where users with repository write access can turn attacker-controlled patch content into a live Git hook to execute shell commands as the Gitea service account. Since Gitea enables registration by default, outside attackers can create accounts and exploit the bug on unmodified installations.

Key Takeaways

  • CVE-2026-60004 (CVSS 9.8) affects Gitea versions 1.17 through 1.27.0, fixed in version 1.27.1
  • Repository writers can convert patch content into a live Git hook for remote code execution
  • Gitea enables registration by default, allowing outside attackers to create accounts and exploit the bug without pre-existing credentials
☕ Buy a Coffee