EUVD-2026-66708
GHSA-rcr6-4jqh-j84m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Gitea instance
-
DeliverySend crafted request with injected code
-
ExploitTrigger code injection (CWE-94)
-
ExecutionExecute arbitrary code on server
-
ImpactSteal secrets and pivot to CI/CD
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation is possible against a network-reachable Gitea instance, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:N (no authentication and no user interaction required). The practical limiting factor is network reachability of the Gitea web service: instances confined to internal networks or behind a VPN are not directly exploitable by external attackers, whereas any internet-facing instance running a version prior to 1.27.1 (Alpine < 1.27.1-r0) is exposed. The input does not specify a particular Gitea feature, non-default setting, or deployment mode as a precondition, so exploitation should be assumed feasible against default configurations until the vendor advisory GHSA-rcr6-4jqh-j84m confirms otherwise. |
| Impact | This should be treated as a top-priority, drop-everything patch. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) indicates remote, low-complexity, unauthenticated exploitation with total impact to confidentiality, integrity, and availability - the maximal-risk profile for a network service. Unlike many high-CVSS findings that stay theoretical, all corroborating signals align upward here: CISA KEV lists it as actively exploited in the wild, and public exploit tooling (a Nuclei template plus a PoC repo) lowers the barrier to mass, automated exploitation. There is no signal-conflict to caveat in this case - KEV, PoC availability, and the CVSS vector all point the same direction, so even a mid-sized operator running a single internet-facing Gitea box should treat this as urgent rather than routine. Note: an EPSS probability score was not provided in the input, so precise exploitation-probability quantification is unavailable, but KEV status already confirms real-world exploitation regardless of EPSS. |
| Exploit ScenarioDerived | An attacker scans the internet for exposed Gitea instances and sends a crafted request that injects attacker-controlled code into a vulnerable execution or template path, achieving code execution on the server without any credentials or user interaction. Because a public Nuclei template and PoC exist, this can be automated at scale against unpatched hosts. Once code runs, the attacker can exfiltrate hosted source and secrets, tamper with repositories, or pivot deeper into the CI/CD and internal network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 26, 2026
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbitrary code on the server, with the issue fixed in Gitea 1.27.1 (Alpine package 1.27.1-r0). The vulnerability is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, including a Nuclei detection template and a proof-of-concept repository. With a CVSS 9.8 network/no-auth vector, any internet-exposed unpatched Gitea instance is at immediate, high risk of full compromise.
Earlier versions of this analysis (1)
Gitea received a security fix in Alpine Linux package version 1.27.1-r0, addressing an unspecified vulnerability in the Gitea self-hosted Git service. The upstream CVE record (CVE-2026-60004) contains minimal public detail - the nature, impact, and exploitability of the underlying flaw are not disclosed in available intelligence sources. Security teams running Gitea on Alpine Linux should treat the package update as a security-relevant change pending further disclosure.
RemediationAI
Upgrade to Gitea 1.27.1 or later immediately; on Alpine Linux install gitea 1.27.1-r0 or newer via the package manager. This is the primary and vendor-confirmed fix (release notes: https://blog.gitea.com/release-of-1.27.1/; advisory: https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m). Until patching completes, reduce exposure by removing the Gitea instance from direct internet reachability - place it behind a VPN or restrict inbound access at the firewall/reverse proxy to trusted source ranges - accepting the trade-off that legitimate remote users and external webhook/CI callers will lose access. Given confirmed active exploitation, also hunt for compromise on any instance that was internet-exposed before patching: review process, webhook, and repository-hook activity, rotate stored tokens/deploy keys/secrets, and inspect for unexpected server-side execution, since a workaround does not remediate an already-breached host.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a lightweight, self-hosted Git service written in Go, widely used as an on-premises alternative to GitHub/GitLab for source hosting, CI triggers, and code collaboration. The root cause is classified as CWE-94 (Improper Control of Generation of Code / code injection), meaning attacker-controlled input is incorporated into a code or template execution path, letting the attacker influence executed instructions rather than just data. The upstream advisory is tracked as GHSA-rcr6-4jqh-j84m and the fix shipped in the 1.27.1 release; the Alpine Linux security tracker records the fixed package as gitea 1.27.1-r0. Because Gitea instances typically hold source code, deploy keys, tokens, and webhook secrets, code execution on the host exposes highly sensitive development assets.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable web service exploitable without authentication or user interaction, and code injection yields full host compromise, so C/I/A are all High.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
3DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.1-r0
Executive ViewAI
Gitea self-hosted Git repository service is actively being exploited via a critical remote code execution vulnerability (CVE-2026-60004, CVSS 9.8) that requires no authentication. Any internet-exposed Gitea instance running versions prior to 1.27.1 faces immediate risk of total system compromise, including source code theft, malware injection, and lateral movement into your infrastructure. Organizations must patch all instances urgently or immediately restrict network access.
Apply vendor patch: Gitea 1.27.1. Until fully patched, implement immediate network isolation-restrict all Gitea server access to internal networks only and block inbound internet traffic; disable public repository access and API endpoints if operationally feasible during the remediation window.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Exploit-DB