Summary
generated automatically from NVD dataGitea versions before 1.27.1 contain a code injection flaw (CWE-94) in the diffpatch API, which can be abused to install Git hooks and achieve remote code execution. The attack works over the network with low complexity and requires no privileges or user interaction, so a successful attack could compromise confidentiality, integrity and availability. It is rated CRITICAL with a CVSS v3.1 score of 9.8 and is listed in the CISA KEV catalog, which means it is actively exploited.
NVD description
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-25. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-08-28
EPSS · FIRST.org
24.0%probability of exploitation in the next 30 days
Higher than 97% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 26 août 2026
- Updated
- 27 août 2026
- Status
- Analyzed
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (5)
- https://blog.gitea.com/release-of-1.27.1/Release Notes
- https://github.com/0xBlackash/CVE-2026-60004ExploitMitigationThird Party Advisory
- https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84mExploitVendor Advisory
- https://www.runzero.com/blog/gitea/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-94
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.