VULNERABILITY INTELLIGENCE
CVE-2026-60004
CVSS score9.8 CRITICAL
EPSS probability23.99%
CISA KEVKnown exploited vulnerability
Published2026-08-26
Last modified2026-08-27
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Exploited Vulnerability
Gitea Code Injection Vulnerability
Vendor / product: Gitea / Gitea
Description
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Weakness classification
- CWE-94: Improper Control of Generation of Code ('Code Injection')
Primary references
- cve@mitre.org — Release Notes
- cve@mitre.org — Exploit, Mitigation, Third Party Advisory
- cve@mitre.org — Exploit, Vendor Advisory
- cve@mitre.org — Third Party Advisory
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource