CVE-2026-60004

CRITICAL(9.8)KEVLikely Exploited

Gitea Code Injection Vulnerability

Description

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

KEV Information

Vendor
Gitea
Product
Gitea
Date Added
August 25, 2026
Due Date
August 28, 2026
Required Action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

CWEs

CWE-94Code Injection

Improper Control of Generation of Code

Affected Products

VendorProductVersion
giteagitea>= 1.17.0, < 1.27.1

References

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score86.78%
EPSS Percentile99.7%

Dates

PublishedAugust 26, 2026
Last ModifiedAugust 27, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch