CVE-2026-60004
published 2026-08-26CVE-2026-60004: Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-08-28
Exploited in the wild
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitea | gitea | >= 1.17 < 1.27.1 | 1.27.1 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Gitea Code Injection Vulnerability
cisa·2026-08-25
CVE-2026-60004 CWE-94 Gitea Code Injection Vulnerability
Vulnerability: Gitea Code Injection Vulnerability
Affected: Gitea Gitea
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 p
VulDB
Gitea up to 1.27.0 Diffpatch API os command injection
vuldb·2026-08-26·CVSS 9.8
CVE-2026-60004 [CRITICAL] Gitea up to 1.27.0 Diffpatch API os command injection
A vulnerability classified as critical was found in Gitea up to 1.27.0. This impacts an unknown function of the component Diffpatch API. The manipulation results in os command injection.
This vulnerability is identified as CVE-2026-60004. The attack can be executed remotely. Additionally, an exploit exists.
Upgrading the affected component is advised.
VulnCheck
Gitea Code Injection Vulnerability
vulncheck·2026
CVE-2026-60004 CWE-94 Gitea Code Injection Vulnerability
Gitea Code Injection Vulnerability
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Affected: Gitea Gitea
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidel
No detection rules found.
Nuclei
Gitea <= 1.27.0 - Pre-Auth Remote Code Execution
nuclei·CVSS 9.8
CVE-2026-60004 Gitea <= 1.27.0 - Pre-Auth Remote Code Execution
Gitea 0'
condition: and
internal: true
extractors:
- type: json
name: branch_sha
json:
- '.commit.id'
internal: true
- raw:
- |
POST /api/v1/repos/{{ruser}}/{{rrepo}}/diffpatch HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
Accept: application/json
Authorization: Basic {{base64(ruser + ":" + rpass)}}
{"content": "diff --git a/hooks/post-index-change b/hooks/post-index-change\nnew file mode 100755\nindex 0000000000000000000000000000000000000000..c205f89dc5a73d8094236a8ef700126084893a73\n--- /dev/null\n+++ b/hooks/post-index-change\n@@ -0,0 +1,14 @@\n+#!/bin/sh\n+git_dir=$(git rev-parse --absolute-git-dir) || exit 1\n+origin_objects=$(sed -n \"1p\" \"$git_dir/objects/info/alternates\") || exit 2\n+case \"$origin_objects\" in\n+ /*) ;;\n+ *) origin_objects=\"$git_dir/objects/$o
Hackernews
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
blogs_hackernews·2026-08-26·CVSS 9.8
CVE-2026-60004 [CRITICAL] Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea.
The vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code execution that allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the Gitea OS user.
"Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content," according to an advisory rele
abuse.ch
URLhaus Malware Distribution: CVE-2026-60004
abuse_ch·2026-08-08
CVE-2026-60004 URLhaus Malware Distribution: CVE-2026-60004
URLhaus Malware Distribution: CVE-2026-60004
URLhaus has tracked 6 malicious URLs associated with 'CVE-2026-60004'.
Activity observed from 2026-08-08 to 2026-08-08.
URL status: offline: 5, online: 1
Top hosting infrastructure:
- 34.70.205.211 (1 URLs)
- kworker.eth.limo (1 URLs)
- 216.98.10.60 (1 URLs)
- 69.30.251.156 (1 URLs)
- 167.179.119.120 (1 URLs)
- kworker.eth.link (1 URLs)
Reported by: anonymous (6)
Hackernews
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
blogs_hackernews·2026-08-05·CVSS 9.8
CVE-2026-59774 [CRITICAL] Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
An unauthenticated attacker can read any file the service account can access on Gitea , the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.
CVE-2026-59774
CVE-2026-60004
Gitea said Cloud instances would be upgraded automatically during the release maintenance window. Self-hosted administrators should move to 1.27.1 immediately.
app.ini
INTERNAL_TOKEN
That chain is described in Gitea's advis
Hackernews
⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
blogs_hackernews·2026-08-03
CVE-2026-42897 ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
This week kept coming back to permission. A model crossed a boundary. A wallet trusted bad randomness. Webmail kept an intruder around. Public systems, package feeds, hotel networks, and login flows all gave away more than intended.
Some of it was clever. Most of it was just access left lying around: old bugs, exposed gear, poisoned dependencies, weak defaults, and tooling that moved from forum chatter to real targets.
The full weekly recap report follows.
## ⚡ Threat of the Week
Anthropic Disclosed its Models Targeted 3 O
Hackernews
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
blogs_hackernews·2026-07-29
CVE-2026-60004 New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A user with ordinary repository write access can turn attacker-controlled patch content into a live Git hook and run shell commands as the Gitea service account.
CVE-2026-60004
Upgrading to 1.27.1 is the fix. Gitea said on July 27 that Gitea Cloud instances would be upgraded automatically. Gitea's July 28 advisory does not say the flaw has been exploited in the wild, but it includes public proof-of-concept (PoC) code.
Disabling open registration can re
2026-08-26
Published
2026-08-25
Added to CISA KEV
Exploited in the wild