A lot of Cyprus software teams and agencies run their own Gitea server: it is the lightweight, self-hosted GitHub alternative that keeps code in-house without a big bill. That convenience just turned into exposure. CVE-2026-60004 (CVSS 9.8) is under active exploitation, sits in CISA’s Known Exploited Vulnerabilities catalog, and is being used in the wild to drop a cryptocurrency miner. If your Gitea faces the internet, this is a today problem.
How a legitimate feature becomes RCE
The flaw is in the diffpatch feature. A user with write access to a repository submits a crafted malicious patch twice, which writes an executable into that repo’s hooks/ directory. Then Git does the rest: server-side hooks (post-receive, update, pre-receive) run on the server during repo operations, so the planted hook executes arbitrary commands as the Gitea service account. A routine patch becomes code execution on the host. Server-side git hooks have been a powerful RCE surface for years — any write into hooks/ is effectively command execution.
Why “needs write access” is not a wall
Gitea ships with open registration on by default. On an unpatched box, anyone from the internet registers a normal account, creates their own repository, gets write access to it, and exploits the bug with no prior credentials — a near-unauthenticated RCE. Public scans show 8,300+ vulnerable servers exposed. The disclosure-to-exploitation window collapsed to days: patched in late July (1.27.1), in KEV with real attacks by late August.
Why this matters for a Cyprus business
A Git server is not a throwaway utility — it is a Tier-0 asset. It holds source code, CI secrets, deploy keys, and cloud and registry tokens. RCE as the service account escalates into a supply-chain and production compromise in a couple of steps, and under GDPR and NIS2 any resulting customer-data exposure is a reportable breach with real fines. The crypto-miner you see today is just the cheap first wave while the attacker decides what else to take.
What to do now
- Upgrade to Gitea 1.27.1 (1.17 and later before 1.27.1 are affected). Do not wait for a maintenance window.
- Disable open registration (
DISABLE_REGISTRATION = true) and take Gitea off the public internet — restrict by IP or put it behind a VPN. - Hunt for traces: unexpected executables in
repositories/<user>/<repo>.git/hooks/, high-CPU processes and outbound connections to mining pools, and freshly created accounts or repos around the attack window. - Rotate deploy keys, CI secrets, and cloud/registry tokens reachable by the service account if the server was exposed. Patching closes the door but does not evict whoever is already in.
For Cyprus teams we find exposed services with external network penetration testing, review the pipeline and code with a secure code review and a container security assessment, and map the blast radius of a compromised build host with an assumed-breach assessment. Get a fixed-price quote and we will check your dev environment.
Sources: Gitea security advisory (1.27.1); The Hacker News, runZero, SecurityWeek; CISA KEV. Exposure counts from public internet scans.