shinthink/CVE-2026-60004

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python exploit for CVE-2026-60004, a pre-authentication RCE in Gitea/Forgejo. It registers an account, creates a repository, and sends a crafted patch twice to the diffpatch API endpoint to trigger a bare-clone hook injection, resulting in arbitrary command execution. The code includes a built-in callback listener for exfiltration and supports mass scanning.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward exploit for CVE-2026-60004. It registers an account, creates a repo, and sends a crafted patch twice to trigger RCE via a Git hook. The hook script executes a user-supplied command and optionally exfiltrates output to a user-controlled callback URL. All behavior is consistent with the stated vulnerability and under the operator's control; no concealed, unrelated, or operator-independent harmful actions were found.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareGiteaForgejo
Attack typesremote code executioncode injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script (cve_2026_60004.py) implements a full exploit chain: it registers an account, creates a repo, and sends a malicious patch to achieve remote code execution. The README describes it as a 'Proof of Concept' and the code includes a 'GiteaExploit' class with an 'exploit' method that triggers the vulnerability. This is not merely a scanner or writeup; it actively exploits the vulnerability to execute arbitrary commands.

cve_2026_60004.py:386cve_2026_60004.py:606README.md:166

Requirements

  • Target Gitea/Forgejo instance with open registration (default) and version < 1.27.1README.md:19cve_2026_60004.py:19
  • Git version >= 2.32 on the target server for three-way merge fallbackREADME.md:67cve_2026_60004.py:13

Observed behavior

  • Registers a new user account on the target Gitea/Forgejo instancecve_2026_60004.py:478-524
  • Creates a new private repository via the APIcve_2026_60004.py:558-579
  • Sends a crafted patch containing a post-index-change hook to the diffpatch API endpoint twice to trigger an add/add conflict and execute the hookcve_2026_60004.py:606-692
  • Exfiltrates command output via an HTTP callback to an attacker-controlled servercve_2026_60004.py:285-358
  • Supports mass scanning of multiple targets with configurable threadscve_2026_60004.py:827-940
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Double-patch submission to /api/v1/repos/{owner}/{repo}/diffpatch to trigger add/add conflict and write hooks/post-index-changeThis is the core of the disclosed CVE-2026-60004 vulnerability and is the expected exploit behavior.cve_2026_60004.py:606-692
Payload Generation
build_hook_and_patch() creates a post-index-change hook that executes a user-supplied command and optionally exfiltrates output via HTTP callbackThe hook's actions (command execution, file write, callback) are all controlled by the operator's --command and --callback arguments. No hidden commands or hardcoded exfiltration endpoints exist.cve_2026_60004.py:285-358
Callback Listener
Built-in HTTP server (CallbackListener) receives base64-encoded command output from the targetThis is a standard feature for capturing output from blind RCE exploits. It only listens and decodes data; it does not execute received data or establish persistence on the operator's machine.cve_2026_60004.py:121-212
Review boundaries

What the analysis did not establish

  • Evidence includes only 3 of 6 files; 3 files are omitted (unclassified_bytes: 7018). The omitted files may contain additional context but are not required for classification.
  • The CVE record (CVE-2026-60004) was absent from the acquired CVEList V5 dataset, so no external CVE description is available for corroboration.
  • Three unclassified files (7018 bytes) were present in the repository but not included as text in the evidence packet; their content was not reviewed.
  • The review is limited to the supplied text evidence and does not include dynamic analysis or execution of the code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1