Vulnerability Disclosure12 Sept 2026·5 sources
Gitea RCE CVE-2026-60004 Exploited: diffpatch API Abused to Run Shell Commands
CVE-2026-60004 is a critical remote code execution flaw in Gitea's diffpatch API, fixed in Gitea 1.27.1 on 27 July 2026. An attacker with repository write access, which open self-registration lets anyone obtain, can install a Git hook and run commands as the Gitea service account. CISA added it to its KEV catalogue on 25 August 2026 after reports of miner-like payloads on unpatched servers.
GiteaCVE-2026-60004RCE+3
