CVE-2026-60004 is a critical RCE vulnerability (CVSS 9.8) in Gitea versions 1.17 through 1.27.0. The flaw resides in the POST /api/v1/repos/{owner}/{repo}/diffpatch API endpoint. The endpoint applies a user-supplied patch inside a shared bare temporary clone using 'git apply' with --index, --recount, --cached, and --binary flags. On servers running Git 2.32 or later, the -3 three-way fallback option is also added. An attacker submits the same patch twice to create an add/add merge collision. The three-way fallback then checks out the indexed path to the filesystem even though --cached is specified. Because the temporary clone is bare, its root is $GIT_DIR. An executable file placed at hooks/post-index-change lands in Git's hook directory and becomes active, executing shell commands as the Gitea service account when Git updates the index. The PoC requires no outbound callback — it stores command output in Git objects, creates a branch with the result, and allows retrieval over authenticated smart HTTP. Exploitation requires: repository write access (obtainable via free registration on default installs), Git 2.32+, an enabled diffpatch route, and a writable/executable temporary filesystem. The fix changes the temporary clone from bare to non-bare, preventing $GIT_DIR from being the working root. A separate file-inclusion vulnerability was also previewed by the same researcher, involving Gitea's Org-mode renderer allowing #+INCLUDE directives to read server filesystem files (e.g., /etc/passwd); fixed in 1.27.1 by returning #+INCLUDE paths as plain text instead of resolving them.