CISA Warns of Active Exploitation of Critical Gitea Code Injection Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical code injection vulnerability in Gitea that is currently being exploited in the wild. The flaw allows attackers to escalate their privileges from simple repository access to full system-level command execution.

Tracked as CVE-2026-60004, the vulnerability centers on a flaw in Gitea's diffpatch API endpoint. According to CISA, an attacker who already possesses write access to a repository can send a malicious patch to this endpoint to plant executable Git hooks. Once these hooks are established, the attacker can execute arbitrary shell commands with the same privileges as the Gitea service account.

The Technical Context

Gitea is a popular self-hosted Git service used by organizations to manage their own source code and development workflows. The diffpatch API is a specific feature designed to apply patches to codebases. In this instance, the vulnerability allows a user to bypass intended security checks, transforming a limited permission—the ability to write to a repository—into a remote code execution (RCE) capability. By manipulating the API to plant a Git hook, the attacker effectively gains a foothold on the underlying server hosting the Gitea instance.

Why It Matters

This vulnerability is particularly dangerous because Gitea is frequently used to host sensitive proprietary source code and manage internal development pipelines. A successful exploit allows an attacker to move beyond the confines of a single project and potentially steal intellectual property, disrupt critical build processes, or use the compromised server as a pivot point to attack other systems within an organization's internal network.

The severity is underscored by CISA's decision to add CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the KEV catalog is a signal to security teams that the flaw is not merely theoretical but is being actively used by threat actors to breach systems.

What's Next

CISA added the vulnerability to the KEV catalog on August 25, 2026, and set a strict remediation deadline of August 28, 2026. Organizations running self-hosted Gitea instances are urged to apply the necessary security patches immediately to close the diffpatch API loophole. Security administrators should also audit repository write permissions to ensure the principle of least privilege is being applied, reducing the number of accounts capable of triggering the exploit.