cve 2026 60004

This tag covers CVE-2026-60004, a critical code-injection vulnerability in Gitea that can lead to remote code execution. The flaw was added to CISA's Known Exploited Vulnerabilities catalog after confirmation of active exploitation. For Windows users running self-hosted Gitea servers, the recommended action is to upgrade to Gitea 1.27.1 or later. Systems exposed with registration enabled should be treated as potential incident-response cases, not just patching exercises. The tag highlights the importance of CISA's KEV inclusion as a statement about real-world exploitation, and provides guidance for securing affected installations on Windows and other platforms.