CVE-2026-60004: Gitea diffpatch Git hook installation leads to remote code execution

GHSA-rcr6-4jqh-j84m describes a critical remote code execution issue in Gitea's diffpatch Git hook installation path. In affected versions >=1.17 and <1.27.1, attacker-controlled patch application in services/repository/files/patch.go can create a repository path collision that causes Git's fallback checkout to install an executable hook file such as hooks/post-index-change inside a shared bare temporary clone. When Git later writes the index, the hook executes as the Gitea OS user. If open registration is enabled, this can be reached by an unauthenticated attacker who creates an account and then a repository. Fixed in 1.27.1.