KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2026-60004
Gitea · Gitea
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Correlated Federal Court Cases & Exploitation Context (0)
No federal court indictment in the current archive directly cites CVE-2026-60004. This record tracks its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-08-25.
Associated Government Advisories
Tracked under CISA Known Exploited Vulnerabilities Binding Operational Directive 22-01 for federal civilian agency remediation.