CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-08-25Vulnerability
CVE-2026-60004
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Properties
- Vulnerability name
- Gitea Code Injection Vulnerability
- Epss score
- 0.23988
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2026-08-28
- Exploited euvd since
- 2026-08-25T00:00:00+00:00
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Date added
- 2026-08-25
- Ghsa updated
- 2026-09-08T17:56:31Z
- Score
- 9.8
- Euvd base score version
- 3.1
- Euvd vendor
- Gitea
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 9.8
- Is ghsa only
- false
- Vendor project
- Gitea
- Content hash
- deed92d5883ea37013444a59dbb543c2fb044fff7936eb5a3d7ccabf762566bd
- Published at
- 2026-08-26T20:17:56.010
- Euvd updated
- 2026-09-08T18:03:21+00:00
- Last modified
- 2026-08-27T11:41:19.230
- Euvd epss pct
- 23.99
Related Entities (8)
MENTIONED_IN (2)
AFFECTS (1)
AFFECTS_PRODUCT (1)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph