CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- Published
- Aug 26, 2026
- Updated
- Sep 8, 2026
- Assigning CNA
- mitre
- Evidence observed
- Aug 26, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 97.8%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Sources
http/cves/2026/CVE-2026-60004.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
- CVE-2026-60004Research
CVE-2026-60004
- CVE-2026-60004Exploit
Gitea diffpatch RCE
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- CVE-2026-60004-poc-giteaExploit
CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection
Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account
- CVE-2026-60004-POCExploit
CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)
- CVE-2026-60004-gitea-0dayExploit
CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE
- CVE-2026-60004Exploit
CVE-2026-60004 — Gitea/Forgejo Diffpatch Git Hook RCE. Bare clone → post-index-change hook injection. CVSS 9.8 | CWE-94 | Gitea < 1.27.1
Automated proof-of-concept exploit for CVE-2026-60004, a Gitea diffpatch Git hook RCE that plants a post-index-change hook to gain a reverse shell as the service account.
- cve-2026-60004Exploit
Detects and exploits a critical pre-auth remote code execution vulnerability in Gitea via the diffpatch endpoint, with a non-intrusive detector and exploit script.
CVE-2026-60004
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.