Exploited Gitea RCE Vulnerability: Protect Your Self-Hosted Git on VPS and Cloud Servers
CISA has added CVE-2026-60004 to its catalog of actively exploited security flaws, targeting Gitea, the lightweight self-hosted Git service many European hosting customers run on VPS, dedicated servers, and cloud instances. Patched in Gitea 1.27.1, released in late July, the bug allows an attacker with repository write access to run shell commands as the Gitea service account through the diffpatch API endpoint. For hosting operators and web agencies using Gitea for deployment pipelines, this is not a theoretical risk: active exploitation means unpatched instances can become footholds for lateral movement, data theft, or downtime. This article breaks down who is affected, why it matters for hosting infrastructure, and the practical steps to remediate before your server becomes a headline. Related ServerSpan guide: Tutorial: How to Install a Self-Hosted Git Server on Your VPS . What CVE-2026-60004 Means in Practice The vulnerability tracked as CVE-2026-60004 is a remote code executi...