CVE-2026-60004

Description

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

CVSS breakdown

Affected products

• Gitea / Gitea1.17 – 1.27.1
• Gitea / Gitea1.17.0 – 1.27.1

Exploits & proofs of concept

• nucleiGitea <= 1.27.0 - Pre-Auth Remote Code Executionby 0x_Akoko

News coverage

• Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like PayloadThe Hacker News · 26d ago

References

• MISChttps://blog.gitea.com/release-of-1.27.1/
• VENDOR_ADVISORYhttps://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
• MISChttps://www.runzero.com/blog/gitea/
• MISChttps://github.com/0xBlackash/CVE-2026-60004