CVE-2026-60004 Exploit Metadata

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-06

Technical assessment

A Python script that automates exploitation of CVE-2026-60004 in Gitea <= 1.27.0 to achieve pre-auth remote code execution via a diffpatch collision, establishing an interactive shell through the Gitea API.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python PoC script (poc.py) for CVE-2026-60004, a Gitea RCE. The script automates exploitation of the described vulnerability to obtain an interactive shell on a target Gitea instance. All behavior is consistent with the stated exploit purpose: it registers a user, creates a repository, plants a Git hook via a diffpatch collision, and uses the hook to execute attacker-supplied commands and return output through the Gitea API. No concealed, unrelated, or operator-directed harmful behavior (such as credential exfiltration, persistence outside the exploit chain, or unrelated payload delivery) was observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesPython

Target softwareGitea

Attack typesRemote Code Execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, automated Python script (poc.py) that exercises the CVE-2026-60004 vulnerability to achieve remote code execution and provides an interactive shell. The README explicitly describes it as a 'proof-of-concept exploit' and the code performs the full exploitation chain.

README.md:4poc.py:1-8

Requirements

Target Gitea instance must have open registration enabled.README.md:21
Target must be running Gitea version 1.17 through 1.27.0.README.md:4

Observed behavior

Registers a new user account on the target Gitea instance.poc.py:116-133
Creates a private repository with auto-initialization.poc.py:135-144
Sends a malicious patch to the /diffpatch API endpoint to plant a post-index-change Git hook via an add/add collision.poc.py:163-201
Executes arbitrary commands on the server by writing them to a tracked file (cmd.sh) that the hook reads and executes.poc.py:163-201
Retrieves command output via the Gitea Raw API endpoint and provides an interactive shell.poc.py:203-231

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain: User registration, repository creation, diffpatch collision to plant post-index-change hook, command execution via hook, output retrieval via raw APIThe entire script implements the described CVE-2026-60004 exploit chain. No extraneous or concealed actions are present.poc.py:233-238poc.py:163-201
Hook Payload: Shell script that reads cmd.sh from the Git index, executes it, and writes output to a blob in the origin repositoryThe hook payload is the core of the exploit. It executes attacker commands and returns output, matching the described RCE mechanism.poc.py:23-45
Command Execution: eval "$cmd"The hook executes the content of cmd.sh, which is set by the attacker via the diffpatch API. This is the intended RCE primitive.poc.py:36
Output Retrieval: GET /api/v1/repos/{user}/{repo}/raw/proof?ref=rce-proofThe script retrieves command output through the Gitea raw API, consistent with the documented API-driven shell approach.poc.py:197-198

Review boundaries

What the analysis did not establish

Only the two text files (README.md and poc.py) were provided and reviewed. No binary files or external dependencies were present in the evidence.
The review does not assess whether the exploit works as claimed or whether the target vulnerability exists.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

CVE-2026-60004