Is CVE-2026-60004 being exploited?

No public exploit is currently tracked. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

How severe is CVE-2026-60004?

CVE-2026-60004 has a CVSS v3 severity of CRITICAL (9.8).

Back

Description

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.