CVE-2026-60004

Published Aug 26, 2026

Last updated 17 days ago

Exploit known CVSS critical 9.8

Cloud

Zero-day

Gitea

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-60004 is a remote code execution (RCE) vulnerability found in Gitea, an open-source, self-hosted Git service. This code injection flaw allows an attacker with repository write access to exploit the `diffpatch` API endpoint. By sending a malicious patch, the attacker can plant an executable Git hook, which then enables them to execute arbitrary shell commands using the privileges of the Gitea service account. The vulnerability affects Gitea versions 1.17 through 1.27.0 and was addressed in version 1.27.1. The Cybersecurity and Infrastructure Security Agency (CISA) has included CVE-2026-60004 in its Known Exploited Vulnerabilities catalog, confirming its active exploitation. In configurations where open self-registration is enabled, an unauthenticated individual can obtain the necessary repository write access by simply registering an account and creating a repository.

Description: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Source: cve@mitre.org
NVD status: Analyzed
Products: gitea

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Gitea Code Injection Vulnerability
Exploit added on: Aug 25, 2026
Exploit action due: Aug 28, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

cve@mitre.org: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:*",
            "matchCriteriaId": "2F773281-54C1-45F3-A53A-1638FC28E83E",
            "versionEndExcluding": "1.27.1",
            "versionStartIncluding": "1.17.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.