Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.1-r0
AnalysisAI
Gitea received a security fix in Alpine Linux package version 1.27.1-r0, addressing an unspecified vulnerability in the Gitea self-hosted Git service. The upstream CVE record (CVE-2026-60004) contains minimal public detail - the nature, impact, and exploitability of the underlying flaw are not disclosed in available intelligence sources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation conditions cannot be determined from available data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk assessment is severely limited by data scarcity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Without technical details, a specific scenario cannot be constructed. Given Gitea's typical deployment as a network-accessible web application, if the vulnerability involves the HTTP interface, a remote attacker could potentially interact with the service to trigger the flaw. … |
| Remediation | Update the Gitea Alpine Linux package to version 1.27.1-r0 or later using the Alpine package manager: 'apk upgrade gitea'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today