Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload

The US Cybersecurity and Infrastructure Security Agency has warned of active exploitation of a critical security flaw in Gitea. The vulnerability, which has a CVSS score of 9.8, allows for remote code execution and enables an attacker with ordinary write access to a repository to execute arbitrary shell commands. This flaw is being exploited to drop a miner-like payload. The issue is identified as CVE-2026-60004. The vulnerability has been recently patched.