CVE-2026-60004

LLM-synthesized narrative grounded in this CVE's description and references.

Versions sourced from the GitHub Security Advisory.

• Go Gitea/Giteallm-fuzzy

  Range: <1.27.1
• osv-coords4 versions

  pkg:apk/chainguard/giteapkg:apk/chainguard/gitea-fipspkg:apk/wolfi/giteapkg:bitnami/gitea

  < 1.27.1-r0+ 3 more

  • (no CPE)range: < 1.27.1-r0
  • (no CPE)range: < 1.27.1-r0
  • (no CPE)range: < 1.27.1-r0
  • (no CPE)range: >= 1.17.0, < 1.27.1

• github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84mnvdExploitVendor AdvisoryWEB
• github.com/advisories/GHSA-rcr6-4jqh-j84mghsaADVISORY
• nvd.nist.gov/vuln/detail/CVE-2026-60004ghsaADVISORY
• www.runzero.com/blog/gitea/nvdThird Party Advisory
• blog.gitea.com/release-of-1.27.1ghsaWEB
• blog.gitea.com/release-of-1.27.1/nvdRelease Notes
• github.com/go-gitea/gitea/commit/470d34b1de87d901bd9135564d5ee18c0d339e82ghsaWEB
• github.com/go-gitea/gitea/commit/d7bc52beeadff4be5f5690de4d5de42abd10affeghsaWEB
• github.com/go-gitea/gitea/pull/38637ghsaWEB
• github.com/go-gitea/gitea/pull/38638ghsaWEB
• github.com/go-gitea/gitea/releases/tag/v1.27.1ghsaWEB
• www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government ResourceWEB
• www.runzero.com/blog/giteaghsaWEB

• Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
  Help Net Security · Aug 30, 2026
• Breach Roundup: A Call for Cyber Defense Collective Action
  GovInfoSecurity · Aug 28, 2026
• CISA Warns of Gitea Code Injection Vulnerability Exploited in Attacks
  Cyber Security News · Aug 27, 2026
• Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
  Help Net Security · Aug 26, 2026
• Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
  The Hacker News · Aug 26, 2026
• CISA Warns of Exploited Gitea Vulnerability
  SecurityWeek · Aug 26, 2026
• CISA Adds One Known Exploited Vulnerability to Catalog
  CISA Alerts