Code injection in Gitea
CVSS Skor
9.8
EPSS İhtimal
%24.0
Risk Skoru
4.7
Yayın
1 ay önce
Public Exploits · GitHub ve Metasploit Intelligence
Bu sekme NVD’nin exploit olarak etiketlediği kaynakları, CVE kimliğiyle eşleşen GitHub depolarını ve Rapid7 Metasploit Framework modüllerini tarar. Yalnızca bulunan gerçek kaynak bağlantıları gösterilir.
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
CVE-2026-60004 es una vulnerabilidad crítica (CVSS 9.8) en Gitea que permite ejecución remota de código sin autenticación mediante el endpoint `/api/v1/repos/{owner}/{repo}/diffpatch`.
CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection
CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE
Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account
CVE-2026-60004 — Gitea/Forgejo Diffpatch Git Hook RCE. Bare clone → post-index-change hook injection. CVSS 9.8 | CWE-94 | Gitea < 1.27.1
CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)
Nuclei: Gitea <= 1.27.0 - Pre-Auth Remote Code Execution
İlgili Benzer Açıklar
Gitea Runner host isolation bypass through container options
Gitea Org-mode file disclosure and code execution
Gitea fork workflow approval bypass through review events
CVE-2026-76819
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
Gitea fork workflow approval bypass through concurrency cancellation
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-60004"