CVE-2026-60004

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

We have discovered 700 live websites that are affected by CVE-2026-60004.

Run a Free Instant Scan



Affected Software

Product  Gitea
Category Dev Tools
Vulnerable Domains700 live websites (93% of Gitea install base)
Vulnerable Versions
  • from 1.17 through 1.27.1
Vulnerable Versions Count47 versions ( 71% of all versions)


Common Weakness Enumeration

CWE-94 Improper Control of Generation of Code ('Code Injection')



Details

  • Published - Aug 26, 2026
  • Updated - Aug 26, 2026

Website Distribution by Country

Number of websites using CVE-2026-60004
United States161 websites


Germany188 websites
France97 websites
Russia46 websites
Singapore39 websites
China18 websites
Czech Republic18 websites
GB15 websites
Netherlands14 websites
Canada9 websites

Website Distribution by TLD

Number of websites using CVE-2026-60004
.com163 websites
.org72 websites
.net72 websites
.de70 websites
.ru31 websites
.fr27 websites
.eu15 websites
.nl13 websites
.cz11 websites
.info10 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-60004

Top websites that are affected by CVE-2026-60004. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.********.com United States***,***
***.*************.org United States***,***
*****.**********.eu Germany***,***
***.*******.net United States***,***
******************.com United States*,***,***
**********.es France*,***,***
****.********.ch Switzerland*,***,***
***.*******.fi Finland*,***,***
***.*********.rip Germany*,***,***
***.************.com France*,***,***
See full domain list

FAQ

CVE-2026-60004 is Improper Control of Generation of Code ('Code Injection') in Gitea
A total of 700 websites have been identified as vulnerable to CVE-2026-60004, based on global website indexing conducted by WebTechSurvey.
The Gitea is affected by the CVE-2026-60004 vulnerability.
Gitea versions up to 1.27.1 are vulnerable to CVE-2026-60004.
CVE-2026-60004 is resolved in version 1.27.1 of Gitea.