A homelab operator discovered CVE-2026-60004 exploited against their Forgejo instance, which was based on an unpatched Gitea RCE vulnerability in the diffpatch endpoint. The attacker gained access through an open sign-up and triggered the exploit via a malicious Git hook in a public repo. The author identified two mistakes: leaving sign-ups enabled and using versioned tags instead of latest, preventing automated update awareness.
Background
Forgejo是Gitea的开源分支，广泛用于个人和小型团队的Git托管服务。CVE-2026-60004是近期披露的远程代码执行漏洞，影响Gitea/Forgejo的diffpatch端点。
- Source
- Lobsters
- Published
- Aug 12, 2026 at 11:50 PM
- Score
- 7.0 / 10