Skip to content
Threat Feed
Subscribe

Product

Forgejo (1.17 - 1.27.0)

1 brief RSS
critical advisory

Critical Pre-Authentication RCE in Gitea and Forgejo

CVE-2026-60004 is a critical pre-authentication RCE vulnerability in Gitea and Forgejo platforms caused by an unsafe bare clone design in the diffpatch API endpoint, enabling arbitrary command execution via injected Git hooks.

Gitea +1 remote-code-execution git vulnerability forgejo
1r 3t