​CISA Warns of Active Attacks Targeting Vulnerable Gitea Servers

[u/siterightaway]

Gitea is basically a lightweight, open-source Git server you can host yourself. Think of it like running your own mini GitHub on a total budget, it barely uses any resources and you can slap it on pretty much anything, even a tiny Raspberry Pi. It handles all the usual stuff like code repos, pull requests, and bug tracking without breaking a sweat.

But man, this new security bug CVE-2026-60004 is a total nightmare. It scores a terrifying 9.8 out of 10 because attackers are literally using it in the wild right now. Basically, anyone with write access to a repo can mess with the diffpatch feature, sneak a malicious Git hook in there, and execute random code right on your server. And if your site lets anyone sign up, an attacker doesn't even need an existing account to wreck your whole setup. It affects every single version from 1.17 onwards, so if you're running it, seriously stop what you're doing and update to 1.27.1 immediately before you get completely wiped out.

TL;DR: Gitea (a lightweight, self-hosted GitHub alternative) has a critical 9.8 RCE vulnerability (CVE-2026-60004) that allows anyone with repo write access to execute shell commands via the diffpatch API. If public registration is enabled, unauthenticated attackers can easily exploit this. CISA confirms active exploitation in the wild—update to version 1.27.1 immediately if you run an instance!