CVE-2026-60004 · Low · CISA KEV

Gitea Code Injection: Repository Write Access Leads to Arbitrary Code Execution

Threat Engine Auto-Feed · data current as of 2026-08-26

CVE-2026-60004 is a code injection vulnerability in Gitea, allowing an attacker with repository write access to execute shell commands as the Gitea service account. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild. Successful exploitation can lead to significant compromise of the Gitea instance and potentially connected systems.

  • CVSS:
  • EPSS percentile:
  • Exploitation pressure: 25/100 (Low)

Exploitation reality: listed in CISA KEV (exploited in the wild). Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves a code injection flaw where an attacker can insert malicious code into an application. Specifically, in Gitea, an attacker with appropriate permissions can submit a specially crafted patch to a specific API endpoint, which then allows them to plant an executable Git hook. This hook, when triggered, executes arbitrary shell commands on the server where Gitea is running, under the privileges of the Gitea service account.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Gitea for source code management, especially those with multiple developers or external collaborators.
  • Financial services organizations, due to documented targeting by financially motivated actors like FIN7, LockBit affiliates, and APT38.
  • Technology companies, given the interest from state-sponsored groups like APT29 and financially motivated groups like Scattered Spider, who target supply chains and SaaS.

Misconfigurations that escalate it

  • Granting repository write access to untrusted or minimally vetted users.
  • Lack of robust access control policies and regular audits for Gitea repository permissions.
  • Running Gitea with elevated privileges for its service account, increasing the impact of code execution.

High-impact scenarios

  • An attacker with repository write access executes arbitrary shell commands, leading to full compromise of the Gitea server.
  • Compromise of the Gitea server could lead to exfiltration of sensitive source code, intellectual property, or credentials.
  • An attacker could use the compromised Gitea instance as a pivot point to access other systems within the network, potentially impacting CI/CD pipelines or connected development environments.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor Gitea server logs for unusual process execution originating from the Gitea service account.
  • Implement file integrity monitoring on Git hook directories within Gitea repositories to detect unauthorized modifications.
  • Review Gitea access logs for suspicious activity from users with repository write access, especially around patch submission endpoints.

Contain

  • Isolate affected Gitea instances from the network if compromise is suspected.
  • Revoke repository write access for suspicious accounts immediately.
  • Implement network segmentation to limit the blast radius of a compromised Gitea server.

Patch

  • Apply the latest security patches and updates from Gitea as soon as they become available to address CVE-2026-60004.

Frontier verdict — Low

This is a critical vulnerability due to active exploitation in the wild (CISA KEV) and the potential for arbitrary code execution on Gitea servers with repository write access.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.