CVE-2026-60004 Gitea Code Injection
Attackers can achieve remote code execution in Gitea by exploiting the diffpatch API to install malicious Git hooks.
- Exploited in the wild
- Since 25 Aug 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-60004?
CVE-2026-60004 is a critical code injection vulnerability in Gitea Gitea, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
Weakness: CWE-94
Which versions are affected by CVE-2026-60004?
5 open source packages ship an affected version, including gitea.dev, gitea and code.gitea.io/gitea. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitea.dev Go | All versions | 1.27.1 |
gitea.dev Go | From 1.17.0 | 1.27.1 |
gitea.dev Go | From 1.17.0 | 1.27.1 |
gitea Bitnami | From 1.17.0 | 1.27.1 |
code.gitea.io/gitea Go | From 1.17.0 | None |
Products include Gitea Gitea.
How do I fix CVE-2026-60004?
Upgrade gitea.dev to 1.27.1 or later. US federal agencies must fix it by 28 Aug 2026.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-60004 being exploited?
Yes. Attackers have exploited CVE-2026-60004 in the wild since at least 25 Aug 2026.
Public exploit code: 1 Nuclei template and 11 proofs of concept on GitHub.
Other vulnerabilities in Gitea Gitea
- CVE-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in
- CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events
- CVE-2022-42968 Gitea vulnerable to Argument Injection
- CVE-2021-45330 Improper Privilege Management in Gitea
- CVE-2021-45331 Reuse of one time passwords allowed in Gitea
Sources
Also known as BIT-gitea-2026-60004, GHSA-rcr6-4jqh-j84m, GO-2026-6433, MINI-252m-7m6c-8xmj, MINI-rx98-74qr-5jgg.