HIGHVulnerability
Verified
Global

CISA KEV: Gitea Gitea — Gitea Code Injection Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.

Analysis

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. Added to CISA Known Exploited Vulnerabilities catalog on 2026-08-25. Remediation due: 2026-08-28.

Indicators of Compromise (1)

CVE (1)
CVE-2026-60004
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Aug 25, 2026. Verified by: CISA.

Related Threats

MEDIUMVulnerability

Capitolis agrees $200m eSecLending acquisition

Capital markets technology provider Capitolis has added securities lending capabilities to its platform through a $200 million all-cash deal to buy eSecLending.

Finextra
MEDIUMVulnerability

Citi launches multi-market instant payments on Swift scheme

Citi has gone live with multiple markets on the Swift payments scheme, enabling bank clients to access multiple cross-border instant payment markets through a single account structure.

Finextra
MEDIUMVulnerability

Zilch eyes 2027 London IPO

Zilch is in talks with banks as it prepares to go public, with the UK-based buy now, pay later provider reportedly leaning towards a London listing.

Finextra