EUVD-2026-101284Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown vector
-
ExploitUnknown exploitation method
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation conditions are unknown - no CVSS vector, CWE, or technical description is available. It is not possible to determine whether exploitation requires authentication, network access, user interaction, or a specific Gitea configuration. The only confirmed fact is that a security patch exists in Alpine package 1.27.3-r0. |
| Impact | Risk cannot be meaningfully quantified from available data. No CVSS vector, EPSS score, KEV status, or POC information is present. The fix is confirmed only via the Alpine Linux package repository, with no upstream Gitea security advisory or CVE details published. Without knowing the attack vector, complexity, privileges required, or impact dimensions, even a basic triage decision is speculative - organizations running Gitea on Alpine Linux should apply the 1.27.3-r0 package update as a precaution without waiting for full disclosure. |
| Exploit ScenarioDerived | The exploit scenario cannot be constructed without knowledge of the vulnerability type, affected component, or required conditions. No public exploit code or proof-of-concept has been identified at time of analysis. Organizations should treat this as an uncharacterized security fix and patch proactively. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
Gitea, the self-hosted Git service, received a security fix in Alpine Linux package version 1.27.3-r0 addressing CVE-2026-60018. The underlying vulnerability type, affected component, and impact are not disclosed in available intelligence sources. No CVSS score, CWE classification, or technical description has been published at time of analysis, making independent severity assessment impossible without reviewing the upstream Gitea changelog or security advisory.
RemediationAI
Update the Alpine Linux gitea package to version 1.27.3-r0 or later using the standard Alpine package manager: 'apk upgrade gitea'. No upstream Gitea advisory URL or alternative workaround is available from the provided intelligence. Until the vulnerability type is publicly disclosed, administrators should also review Gitea's network exposure - if the instance is publicly accessible and not required to be, restricting access to trusted networks via firewall rules is a prudent compensating control with minimal operational impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gitea is a lightweight, self-hosted Git service written in Go, widely used by individuals and organizations as a GitHub alternative. The fix is delivered via the Alpine Linux package ecosystem as gitea 1.27.3-r0. No CWE is assigned and no CVSS vector is provided, so the root-cause class - whether it involves authentication bypass, injection, privilege escalation, or another category - cannot be determined from the available data. The Alpine package version string suggests this is a security patch release, but the upstream Gitea version correspondence (e.g., whether 1.27.3-r0 maps to Gitea 1.23.x or another upstream tag) is not confirmed.
Know when Gitea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (vendor:alpine) · only source for this CVE.
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: gitea fixed in 1.27.3-r0
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Gitea (self-hosted Git service) via a code-injection flaw (CWE-94) allows attackers to run arbi
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Path traversal in Gitea's Org-mode (`.org`) markup renderer allows an attacker who can get Org-mode content rendered by
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Exploit-DB