CVE-2026-60004: Gitea diffpatch Git Hook Installation Remote Code Execution Exploit PoC

Successful exploitation may expose app.ini, process environment secrets, mounted repositories, database and OAuth or integration credentials, and other reachable services. Upgrade to Gitea 1.27.1 or later immediately. Until patched, restrict open registration and repository creation, and review temporary-filesystem and service-account permissions.

Affects all WordPress installations from version 4.7.0 through 7.1.0 without requiring credentials or interaction beyond opening a post. Administrators should verify upgrading to 7.1.1 or backported releases, and monitor server logs for suspicious comment payloads and unexpected plugin uploads.

While remote code execution depends on runtime prerequisites like PEAR, the unauthenticated LFI primitive resides directly in WordPress Core and affects all major branches from 4.7.0 through 7.1.1.

A Google Project Zero post that walks through developing a reliable exploit for an Adobe Reader font vulnerability to achieve remote code execution.

Dynamic Open Graph image generation is common in Next.js apps; any route accepting user parameters to customize SVG cards could lead to full Node.js server compromise.

libheif is a core dependency for HEIF and AVIF image decoding across servers and desktop utilities; services that accept user-uploaded images and transcode them are susceptible to remote crashes and heap exploitation.