Gitea
CVE-2026-60004
CVE-2026-60004 Gitea diffpatch Git-hook installation
OVERVIEW
Lab observed
Vendor reported
Vendor-reported fixed versions
1.27.1Only the lab versions above were independently reproduced by CVE Mapping.
LAB OBSERVED
What this lab demonstrates
The fixed marker appeared on 1.27.0 after one controlled request and remained absent on 1.27.1 after the equivalent request.
The vulnerable and patched modes used equivalent controlled actions. Application state—not a successful HTTP status alone—is decisive.
VULNERABLE VS PATCHED RESULT
Runtime accepted and the documented state difference was observed.
Runtime accepted and the expected safe state was retained.
Evidence, telemetry, and detection checks are recorded in the manifest.
DETECTION COVERAGE
Detection engineering
- Sigma1 lab-validated analytic
- Splunk1 lab-validated analytic
- Elastic1 lab-validated analytic
Request telemetry provides context, while the strongest analytic requires correlated application-state telemetry. A request alone does not prove exploitation.
FIXTURE DISCRIMINATION
Lab fixture performance
Validated state-change analytics matched vulnerable activity and did not match patched or benign controls. Contextual analytics are reported separately and are not promoted to vulnerability discriminators.
EVIDENCE & TELEMETRY
Preserved and verifiable
Sanitized evidence and normalized telemetry are tracked by manifest and SHA-256 integrity files.
RISK CONTEXT
Vendor enrichment
Additional risk feeds are omitted without a verified current lookup.
MITRE ATT&CK
Unassigned
REPRODUCE LOCALLY
Start with the Quickstart.
Use the repository operator workflow on a disposable, localhost-only environment. The website does not embed proof payload content.
Open QuickstartLIMITATIONS & SAFETY
Scope stays explicit.
The lab does not claim independent reproduction of every vendor-reported version. It requires authorized defensive use, synthetic identity, and a bounded controlled proof.