Exploit for CVE-2026-60004

cve · 2026-08-26

Description

RCE in Gitea before 1.27.1 via the diffpatch API through Git hook installation.

Affected Gitea versions

Gitea< 1.27.1

All known vulnerabilities by product

CVSS 9.8 for CVE-2026-60004

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

84.6%higher than 99.7% of all CVEs

Updated 2026-08-29

CVE Information

References

https://github.com/0xBlackash/CVE-2026-60004

https://www.runzero.com/blog/gitea/

https://blog.gitea.com/release-of-1.27.1/

https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60004

Exploit Details

Modified:2026-08-27 11:41

Last Seen:2026-08-27 11:52

Reporter:mitre

Tags

GiteaRemote Code Executiondiffpatch APIGit hook installationBefore 1.27.1

Other exploits for CVE-2026-60004

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

CVE-2026-60004-gitea-0day

2026-08-28 KitPloitKITPLOIT

CVE-2026-60004-poc-gitea

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

CVE-2026-60004-POC

2026-08-27 KitPloitKITPLOIT

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.