9 matches found
SUSE CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
BIT-GITEA-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
ALPINE-CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation...
CVE-2026-60004
CVE-2026-60004 is a critical RCE in Gitea (and Forgejo ) versions 1.17–1.27.0 (CVSS 9.8). The flaw is in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, where patches are applied in a bare temporary clone whose root is $GIT_DIR. Submitting the same malicious patch twice triggers an add/...
