Gitea diffpatch RCE exploitation (CVE-2026-60004) - Git hooks write

Ankit Mehta@Secvyn

•updated Sep 28, 2026•0•0•4

Detects incoming HTTP POST requests to the 'diffpatch' endpoint in Gitea that contain suspicious 'diff --git' patterns combined with path traversal sequences ('../') targeting 'hooks/' directories. This indicates an attempt to exploit CVE-2026-60004 to achieve unauthorized file system access or remote code execution via repository hooks.