Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Gitea diffpatch endpoint RCE (CVE-2026-60004)

Vulnerability
First reported
Last updated
Happening score
H score 41
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2026-60004 is a critical remote code execution flaw in Gitea that lets a user with repository write access run shell commands as the Gitea service account. The bug affects Gitea 1.17 through 1.27.0 and is fixed in 1.27.1. Public proof-of-concept code is available, raising the risk of rapid exploitation on exposed installations.

Related Happenings

Gitea Org-mode file-read flaw (CVE-2026-59774)

Vulnerability
H score60 First: 05.08.2026 14:04 Last: 05.08.2026 14:04 Sources 1

About this happening: A Critical CVE-2026-59774 flaw in Gitea lets an unauthenticated attacker read files the service account can access on versions 1.22.1 through 1.27.0, and 1.27.1*...

Open Happening

Vim and GNU Emacs file-open RCE flaws remote code execution flaw

Vulnerability
H score28 First: 01.04.2026 00:45 Last: 01.04.2026 00:45 Sources 1

About this happening: Vim and GNU Emacs have file-open remote code execution flaws that can run attacker code as soon as a crafted file is opened. The Vim issue affects 9.2.0271 and e...

Open Happening

Timeline

  1. 29.07.2026 10:47 1 articles · 13d ago

    Gitea backports the diffpatch hook fix

    Mitigation Patch Update

    Gitea changed the temporary clone used by POST /api/v1/repos/{owner}/{repo}/diffpatch from bare to non-bare, closing the hook-placement behavior that let an executable file land in hooks/post-index-change and become active while Git updated the index.

    Show sources
    Open in new tab
  3. 28.07.2026 03:00 2 articles · 15d ago

    Gitea issues advisory for CVE-2026-60004 and publishes PoC code

    Initial Disclosure

    Gitea's July 28 security advisory for CVE-2026-60004 says the flaw had not been exploited in the wild and includes public proof-of-concept code. Gitea also credits security researcher Shai Rod, who goes by NightRang3r, as the reporter.

    Show sources
    Open in new tab