SecurityOnlineDo Son
CVE-2026-60004: Gitea RCE lets attackers run code via Git hook
Part of the CVE-2026-60004 story · since 29 Jul
Quiet for 6 weekslast report 15 Sep7 articles4 outlets
- Wed 29 Jul, 10:11 UTC. SecurityOnline, first report. CVE-2026-60004: Gitea RCE lets attackers run code via Git hook. Cites a CVE in CISA KEV. This article, 1st of 7.
- Tue 25 Aug, 22:43 UTC. CISA, its first report on the story. CISA Flags Gitea Code Injection Flaw in KEV Catalogue. Cites a CVE in CISA KEV.
- Wed 26 Aug, 05:50 UTC. SecurityWeek, its first report on the story. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28. Cites a CVE in CISA KEV.
- Wed 26 Aug, 09:45 UTC. Security Affairs, its first report on the story. CISA Adds Critical Gitea Flaw CVE-2026-60004 to Exploit List. Cites a CVE in CISA KEV.
- Wed 26 Aug, 14:26 UTC. CISA. CISA's KEV Catalog Adds Gitea Flaw, Urges Prompt Patching. Cites a CVE in CISA KEV.
- Mon 31 Aug, 02:31 UTC. SecurityOnline. Weekly CVE Report: 11 Exploited Flaws Added to KEV. Cites a CVE in CISA KEV.
- Tue 15 Sep, 04:41 UTC. SecurityOnline. Chinese-Linked Hackers Exploit Critical Gitea Flaw to Steal Data. Cites a CVE in CISA KEV.
Gitea has a critical Remote Code Execution (RCE) vulnerability tracked as CVE-2026-60004, with a CVSS score of 9.8. Users with repository write access can execute shell commands as the Gitea service account. The vulnerability is located in the diffpatch endpoint, allowing attackers to exploit it and run commands via a malicious Git hook. Affected versions are from 1.17 to below 1.27.1, requiring Git 2.32 or newer with enabled diffpatch. To mitigate, users should update to Gitea 1.27.1 or disable open registration.
How the story developed
Quiet for 6 weekslast report 15 Sep7 articles4 outlets
7 articles from 4 outlets since 29 Jul. Quiet since 15 Sep. This was the first report.
- Wed 29 Jul, 10:11 UTC. SecurityOnline, first report. CVE-2026-60004: Gitea RCE lets attackers run code via Git hook. Cites a CVE in CISA KEV. This article, 1st of 7.
- Tue 25 Aug, 22:43 UTC. CISA, its first report on the story. CISA Flags Gitea Code Injection Flaw in KEV Catalogue. Cites a CVE in CISA KEV.
- Wed 26 Aug, 05:50 UTC. SecurityWeek, its first report on the story. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28. Cites a CVE in CISA KEV.
- Wed 26 Aug, 09:45 UTC. Security Affairs, its first report on the story. CISA Adds Critical Gitea Flaw CVE-2026-60004 to Exploit List. Cites a CVE in CISA KEV.
- Wed 26 Aug, 14:26 UTC. CISA. CISA's KEV Catalog Adds Gitea Flaw, Urges Prompt Patching. Cites a CVE in CISA KEV.
- Mon 31 Aug, 02:31 UTC. SecurityOnline. Weekly CVE Report: 11 Exploited Flaws Added to KEV. Cites a CVE in CISA KEV.
- Tue 15 Sep, 04:41 UTC. SecurityOnline. Chinese-Linked Hackers Exploit Critical Gitea Flaw to Steal Data. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Wed 29 JulDay 01
- CVE-2026-60004: Gitea RCE lets attackers run code via Git hook10:11 · SecurityOnline · First report · Exploited CVE · Known exploited CVE · This article, 1st of 7
Quiet for 4 weeks
Tue 25 AugDay 271- CISA Flags Gitea Code Injection Flaw in KEV Catalogue22:43 · CISA · official · CISA alert · Picked up again · Known exploited CVE
- Wed 26 AugDay 283
- CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 2805:50 · SecurityWeek · Known exploited CVE
- CISA Adds Critical Gitea Flaw CVE-2026-60004 to Exploit List09:45 · Security Affairs · Known exploited CVE
- CISA's KEV Catalog Adds Gitea Flaw, Urges Prompt Patching14:26 · CISA · official · Known exploited CVE
Quiet for 5 days
Mon 31 AugDay 331- Weekly CVE Report: 11 Exploited Flaws Added to KEV02:31 · SecurityOnline · Picked up again · Known exploited CVE
Quiet for 2 weeks
Tue 15 SepDay 481- Chinese-Linked Hackers Exploit Critical Gitea Flaw to Steal Data04:41 · SecurityOnline · Picked up again · Known exploited CVE