Back to Live Pulse

Critical

Gitea

Code Injection

CVE-2026-60004

Description

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Proof of Concept (POC) Links

Explore how this vulnerability can be reproduced or exploited.

https://github.com/0xBlackash/CVE-2026-60004 https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004