Feed/CVE-2026-60004
CVE-2026-60004CRITICALCVSS 9.8CISA KEV: Actively Exploited

Gitea Code Injection Vulnerability

Published Aug 25, 2026·Updated Sep 8, 2026

NVD Description

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Packages (1)

gitea.devGO
From 1.17.0
Fixed in 1.27.1

Public Exploits & PoCs12 found

[POC] GHSA-8gj2-2cvc-6xx7 — CVE-2026-60004-POC

CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)

1

[POC] GHSA-8gj2-2cvc-6xx7 — CVE-2026-60004

Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account

1

[POC] GHSA-3whf-vgf2-9w6g — CVE-2026-60004

Gitea diffpatch RCE

1

[POC] GHSA-8gj2-2cvc-6xx7 — CVE-2026-60004-gitea-0day

CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE

[POC] GHSA-3whf-vgf2-9w6g — CVE-2026-60004

CVE-2026-60004

[POC] GHSA-3whf-vgf2-9w6g — CVE-2026-60004

CVE-2026-60004

[POC] GHSA-8gj2-2cvc-6xx7 — CVE-2026-60004

CVE-2026-60004 — Gitea/Forgejo Diffpatch Git Hook RCE. Bare clone → post-index-change hook injection. CVSS 9.8 | CWE-94 | Gitea < 1.27.1

PoC: CVE-2026-60004-PoC

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

PoC: CVE-2026-60004-Gitea-RCE-PoC

🫖 Direct single-target Gitea CVE-2026-60004 RCE validation PoC

PoC: CVE-2026-60004-Gitea-Validator

🫖 Contract-correlated discovery and authorized validation tool for Gitea CVE-2026-60004

PoC: cve-2026-60004

CVE-2026-60004 es una vulnerabilidad crítica (CVSS 9.8) en Gitea que permite ejecución remota de código sin autenticación mediante el endpoint `/api/v1/repos/{owner}/{repo}/diffpatch`.

PoC: CVE-2026-60004-poc-gitea

CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Register your stack and get notified within minutes when a matching CVE drops.

Start monitoring free