CVE-2026-60004 is a critical pre-authentication RCE vulnerability in Gitea and Forgejo platforms caused by an unsafe bare clone design in the diffpatch API endpoint, enabling arbitrary command execution via injected Git hooks.
Gitea +2
remote-code-execution
git
vulnerability
forgejo
1r
3t
1c
updated