Code injection in Gitea
CVSS Skor
9.8
EPSS İhtimal
%24.0
Risk Skoru
4.7
Yayın
1 ay önce
Public Exploits · GitHub ve Metasploit Intelligence
Bu sekme NVD’nin exploit olarak etiketlediği kaynakları, CVE kimliğiyle eşleşen GitHub depolarını ve Rapid7 Metasploit Framework modüllerini tarar. Yalnızca bulunan gerçek kaynak bağlantıları gösterilir.
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
CVE-2026-60004 es una vulnerabilidad crítica (CVSS 9.8) en Gitea que permite ejecución remota de código sin autenticación mediante el endpoint `/api/v1/repos/{owner}/{repo}/diffpatch`.
CVE-2026-60004 — Gitea Pre-Auth RCE via diffpatch hook injection
CVE-2026-60004 — Gitea <= 1.27.0 Pre-Auth RCE
Gitea diffpatch RCE (CVE-2026-60004) PoC - repo-write to RCE as Gitea service account
CVE-2026-60004 — Gitea/Forgejo Diffpatch Git Hook RCE. Bare clone → post-index-change hook injection. CVSS 9.8 | CWE-94 | Gitea < 1.27.1
CVE-2026-60004 Pre-Auth RCE Exploit — Gitea <= 1.27.0 diffpatch git hook injection (CVSS 9.8)
Nuclei: Gitea <= 1.27.0 - Pre-Auth Remote Code Execution
İlgili Benzer Açıklar
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled
CVE-2026-76819
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
Joker linter executed project-local .jokerd/linter.* files during linting
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass
Bu açığı API ile alın
Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2026-60004"