[KEV] CVE-2026-60004 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-60004 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-60004 is a code injection vulnerability in Gitea’s diffpatch API endpoint that can allow a user with repository write access to install a malicious executable Git hook.

Technical Detail

An authenticated attacker with write access to a repository can submit a crafted patch to the diffpatch API endpoint. The flaw can be used to plant an executable Git hook that runs shell commands under the Gitea service account when the hook is invoked. Successful exploitation results in remote code execution in the security context of the Gitea service account and may enable access to repositories, credentials, and other resources available to that account.

Exploitation Status

Exploit maturity is assessed as Operational, meaning exploit capability is considered usable in real-world attack activity rather than limited to a conceptual proof of concept. CISA has confirmed active exploitation in the wild. CVE-2026-60004 was added to the CISA Known Exploited Vulnerabilities catalog on August 25, 2026.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Apply the vendor-provided security update for Gitea as a priority, particularly for instances that permit repository write access to users, automation accounts, or external collaborators. CISA binding directive requirements apply to affected federal civilian executive branch agencies: patch by the deadline specified in the CISA KEV catalog or apply mitigations. Until patching is complete, restrict repository write access to essential trusted users, review access granted to service and automation accounts, and limit network exposure of Gitea administrative and API interfaces where feasible. Investigate for unexpected files or modifications in Git hook directories, newly created executable hooks, and shell processes spawned by the Gitea service account.