CVE-2026-60004
Gitea · Published August 26, 2026
9.8
CVSS v3.1
CRITICALCISA KEV — Federal agencies must patch by deadline
Actively exploited in the wild
Patch availableGet patch
Description
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Affected Products
- Gitea < 1.27.1
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H