CVE-2026-60004
KEVCRITICAL 9.8EPSS 24.0%
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- Affected
- Gitea
- CVSS v3.1 MITRE
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 23.99% chance of exploitation in the next 30 days, 98th percentile
- CISA KEV
- added 2026-08-25
- Nuclei
- critical · CWE-94
- Published
- 2026-08-26
- Updated
- 2026-09-08
Proof-of-concept exploits (12)
- advisories/GHSA-rcr6-4jqh-j84m
- HORKimhab/CVE-2026-600045★ · 2026-07-29
- 0xBlackash/CVE-2026-600046★ · 2026-07-30
- EQSTLab/CVE-2026-600041★ · 2026-08-19
- imbas007/CVE-2026-60004-POC17★ · 2026-08-03
- gagaltotal/CVE-2026-60004-poc-gitea2★ · 2026-08-08
- fevar54/cve-2026-600040★ · 2026-08-25
- HackSpeak/CVE-2026-600042★ · 2026-08-04
- shinthink/CVE-2026-600040★ · 2026-08-03
- Sachinart/CVE-2026-60004-gitea-0day0★ · 2026-08-04
- erberkan/CVE-2026-60004-PoC0★ · 2026-09-14
- yym8538/CVE-2026-600041★ · 2026-08-21
Nuclei templates (1)
Security advisories
- go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
- https://www.runzero.com/blog/gitea
- https://blog.gitea.com/release-of-1.27.1