A self-hosted Forgejo instance was compromised via CVE-2026-60004, an RCE vulnerability in Gitea's diffpatch endpoint that Forgejo inherited. The attacker exploited an open sign-up form (which the author thought was disabled) and an outdated, EOL v13 image tag to create a malicious repo with a Git hook that downloaded and executed a cryptocurrency miner. The postmortem walks through log analysis, the exploit's similarity to a public GitHub POC and Nuclei template, and remediation steps: rolling back to a clean backup, upgrading to v16, disabling open signups and local auth, and plans to restrict per-container network access.
Questions this post answers
What is CVE-2026-60004 and how does it affect Gitea and Forgejo?
CVE-2026-60004 is a remote code execution vulnerability in Gitea's diffpatch API endpoint, which Forgejo inherited since it is based on Gitea. An attacker can push a malicious repository containing a crafted Git hook, then trigger the diffpatch endpoint to execute the hook and gain code execution on the server. The bug was patched in Gitea and in Forgejo's latest v15 LTS and v16 releases. Track newly disclosed CVEs like this one on daily.dev before they hit an unpatched self-hosted instance.
How can I tell if my Forgejo or Gitea server was exploited by the diffpatch RCE?
Check server logs for at least two POST requests to /api/v1/repos/USER/REPO/diffpatch, often preceded by a sign-up, repo creation, and branch check within a few seconds, indicating a scripted attack. Look for unexpected users with a single repo containing a README and a hooks folder with a post-index-change script that curls an external IP and executes a payload. Developers auditing self-hosted git servers can follow incident writeups like this one on daily.dev.
Why was an old Forgejo container still vulnerable to a patched CVE?
The instance was pinned to Forgejo v13, which reached end-of-life in January 2026, roughly six months before the exploit occurred, because Forgejo does not publish a 'latest' image tag and updates require manually checking versioned tags. The CVE had already been fixed in v15 LTS and v16, so staying on the outdated, unsupported v13 left the server exposed. Keeping pinned container versions current is easier when you track EOL and security news for tools like Forgejo on daily.dev.