Vulnerability Disclosure12 Sept 2026·6 sources
Gitea RCE CVE-2026-60004: Unauthenticated Attackers Execute Shell Commands via diffpatch
Gitea disclosed CVE-2026-60004, a critical remote code execution vulnerability in the diffpatch feature that allows unauthenticated remote attackers to write malicious Git hooks and execute arbitrary shell commands as the Gitea process user on default installations with open self-registration enabled.
GiteaCVE-2026-60004RCE+3
