CVE-2026-60004 - Vulnerability Details - OpenCVE

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since yesterday.

No EPSS score available.

Exploitation active

Automatable yes

Technical Impact total

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://blog.gitea.com/release-of-1.27.1/
https://github.com/0xBlackash/CVE-2026-60004
https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004
https://www.runzero.com/blog/gitea/

History

Wed, 26 Aug 2026 21:30:00 +0000

Type	Values Removed	Values Added
References		https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 26 Aug 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Weaknesses		CWE-94
References		https://blog.gitea.com/release-of-1.27.1/ https://github.com/0xBlackash/CVE-2026-60004 https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m https://www.runzero.com/blog/gitea/
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` kev `{'dateAdded': '2026-08-25T00:00:00+00:00', 'dueDate': '2026-08-28T00:00:00+00:00'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-08-26T19:45:00.000Z

Updated: 2026-08-26T20:30:56.558Z

Reserved: 2026-07-08T09:19:08.764Z

Link: CVE-2026-60004

Vulnrichment

Updated: 2026-08-26T20:22:53.760Z

NVD

Status : Undergoing Analysis

Published: 2026-08-26T20:17:56.010

Modified: 2026-08-26T21:16:38.890

Link: CVE-2026-60004

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-94

{"containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThan": "1.27.1", "status": "affected", "version": "1.17", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2026-08-26T19:45:00.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"url": "https://blog.gitea.com/release-of-1.27.1/"}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m"}, {"url": "https://www.runzero.com/blog/gitea/"}, {"url": "https://github.com/0xBlackash/CVE-2026-60004"}], "x_generator": {"engine": "Record Generation 0.0.1"}}, "adp": [{"references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004", "tags": ["government-resource"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-26T20:21:46.783249Z", "id": "CVE-2026-60004", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2026-08-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T20:30:56.558Z"}}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "datePublished": "2026-08-26T19:45:00.000Z", "dateReserved": "2026-07-08T09:19:08.764Z", "dateUpdated": "2026-08-26T20:30:56.558Z", "cveId": "CVE-2026-60004", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-60004", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T20:21:46.783249Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2026-08-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004"}}}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004", "tags": ["government-resource"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T20:22:53.760Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "1.17", "lessThan": "1.27.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.gitea.com/release-of-1.27.1/"}, {"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m"}, {"url": "https://www.runzero.com/blog/gitea/"}, {"url": "https://github.com/0xBlackash/CVE-2026-60004"}], "x_generator": {"engine": "Record Generation 0.0.1"}, "descriptions": [{"lang": "en", "value": "Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-26T19:45:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2026-60004", "state": "PUBLISHED", "dateUpdated": "2026-08-26T20:30:56.558Z", "dateReserved": "2026-07-08T09:19:08.764Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-08-26T19:45:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}