9.8

CVE-2026-60004: Gitea Code Injection Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed
AliasesCGA-22cf-47g3-fpvgCGA-f9cp-p2mf-hmjwGHSA-rcr6-4jqh-j84m
Published 26-08-2026Last modified 08-09-2026
Open JSON

Vulnerability summary

CVE-2026-60004 is a critical (CVSS 9.8) Code Injection vulnerability in Gitea. It is known to be exploited: CISA lists it, first on 25-08-2026. EPSS estimates a 23.99% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
23.99%
0%100%
High · -62.79 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2github

Advisory lineage

Upstream 0 · Downstream 3 · Related 4
OPENSUSE-SU-2026:21897-1SUSE-SU-2026:23855-1SUSE-SU-2026:23863-1CGA-FX3J-3554-2PH4

Timeline

  1. 25-08-2026
    Added to CISA KEVGitea Code Injection Vulnerability
  2. 26-08-2026
    PublishedVulnerability first disclosed.
  3. 28-08-2026
    CISA remediation dueApply mitigations per vendor instructions.
  4. 08-09-2026
    Last modifiedVulnerability information updated.

Description

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

23.99%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

-62.79 pp

From 86.78% on 18-09-2026

18-09-202618-10-2026
EPSS score
23.99%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
25-08-2026
Federal due date
28-08-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m nvd.nist.gov/vuln/detail/CVE-2026-60004

Public exploits

2 found
  • githubUnverified

    Gitea

    Maturity: poc

  • githubUnverified

    Cve 2026 60004

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard2 products
  • gitea< 1.27.1-r0
  • gitea-fips< 1.27.1-r0
Code.gitea.io1 product
  • gitea≥ 1.17.0 (No fix recorded)
Gitea1 product
  • gitea≥ 1.17, < 1.27.1 | ≥ 1.17.0, < 1.27.1
Go1 product
  • gitea.dev≥ 1.17.0, < 1.27.1 | < 1.27.1
Wolfi1 product
  • gitea< 1.27.1-r0

5 vendors · 6 products

References

15 links
Show all 15 references