Known vulnerability record

CVE-2026-60004

Gitea Code Injection Vulnerability

Stable IDcve:CVE-2026-60004Source record date2026-08-26Human reviewNot recordedProvenanceSource-linked CVE, KEV, and EPSS signals

Summary

Gitea Code Injection Vulnerability

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.

Vulns.co field classification

Code execution on enterprise application

Derived analysis: these labels are inferred from the source title, product, and summary. They are not vendor, CVE, CISA, or FIRST classifications.

Failure classCode execution

Product laneEnterprise application

Attention stateKnown exploited, ransomware use unknown

Hunter pivot

Establish the exact reachable primitive and its preconditions. Use a harmless marker if authorized, preserve a clean control, and stop before persistence, secret access, or lateral movement.

Signals

Keep the signals separate

CVSS severitycriticalScore 9.8 · source mitre

EPSS probability82.4%Probability of exploitation in the next 30 days; not severity

CISA KEVKnown exploitedAdded 2026-08-25

Ransomware useunknownPreserved as known / unknown, not a truthy default

Research boundary

Confirm the product before the behavior.

Match the exact product, build, deployment mode, and exposed component.
Read the vendor advisory and current program policy.
Choose one non-destructive discriminator with an explicit negative control.
Stop at the first sufficient proof. A CVE match is context, not permission.

Timeline

Dates and provenance

CVE published: 2026-08-26
CVE modified: 2026-08-26
KEV date added: 2026-08-25
Dataset fetched: 2026-08-28T13:17:16.813Z

Sources

Original records

Version history: normalized permanent page created 2026-08-20. Machine-enriched fields remain source-attributed.