CVE Tools
Sign in
Back to feed
Exploited in the wild Gitea rce web-app

CISA Warns of Exploited Gitea Vulnerability

SecurityWeek·By Eduard Kovacs··1 min read
CVE Tools coverage

CISA has identified active exploitation of a remote code execution flaw in the self-hosted Git hosting platform Gitea. The vulnerability, designated as CVE-2026-60004, enables attackers with repository write access to inject malicious Git hooks through the diffpatch API endpoint. This defect was remediated in release version 1.27.1, and the agency has mandated that federal systems apply the patch immediately.

Open on SecurityWeek

Related coverage

Other stories on the same CVEs
Worried this affects your company?

See what your business actually exposes to the Internet — a free external review, no install, no obligation.

Check my exposure