imbas007/CVE-2026-60004-POC

GitHubRepository PoCExploit

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a full exploit chain for CVE-2026-60004, a pre-auth remote code execution vulnerability in Gitea. It includes a Python script (cve-2026-60004-poc.py) that registers a user, creates a repository, sends malicious diff patches to trigger a Git hook injection, and retrieves command output. A Nuclei template (CVE-2026-60004.yaml) also performs the full exploit chain. The README documents the exploit and provides usage instructions.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Nuclei template, a README, and a Python PoC script for CVE-2026-60004, a Gitea RCE vulnerability. All three files describe and implement the same exploit chain: register a user, create a repo, send a crafted diffpatch to inject a Git hook, and retrieve command output. The Python script uses only standard library modules and performs no unrelated network activity, persistence, credential exfiltration, or concealed payload delivery. The hook payload is generated transparently from the user-supplied --cmd argument. No backdoor or deceptive behavior was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonYAML
Target softwareGitea
Attack typesRemote Code ExecutionCode Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script and Nuclei template both contain code that actively exploits the vulnerability by sending malicious patches to achieve remote code execution and retrieve command output. The README describes the exploit chain and provides usage examples for exploitation. This is not merely a scanner or writeup; it is a functional exploit.

cve-2026-60004-poc.py:444-503CVE-2026-60004.yaml:152-195README.md:69-93

Requirements

  • Target Gitea instance must have open registration enabled for full-auto mode, or attacker must have valid credentials for semi-auto/manual modes.cve-2026-60004-poc.py:293-314cve-2026-60004-poc.py:702-704
  • Target Gitea version must be between 1.17 and 1.27.0 (inclusive).CVE-2026-60004.yaml:8-10cve-2026-60004-poc.py:17-18

Observed behavior

  • Registers a new user on the target Gitea instance via the signup page.cve-2026-60004-poc.py:316-352CVE-2026-60004.yaml:91-108
  • Creates a private repository with auto-init on the target instance.cve-2026-60004-poc.py:356-384CVE-2026-60004.yaml:110-126
  • Sends a crafted Git diff patch multiple times to the diffpatch API endpoint to trigger an add/add collision, which writes a malicious post-index-change hook into the bare repository's hooks directory.cve-2026-60004-poc.py:410-503CVE-2026-60004.yaml:152-195
  • The injected hook executes an attacker-supplied command, captures the output, and stores it in a Git blob in the origin repository, creating a new branch named 'rce-proof'.cve-2026-60004-poc.py:122-145CVE-2026-60004.yaml:162
  • Retrieves the command output by fetching the 'proof' file from the 'rce-proof' branch via the raw API endpoint.cve-2026-60004-poc.py:507-544CVE-2026-60004.yaml:197-215
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
User registration, repository creation, diffpatch hook injection, output retrievalThe PoC implements the documented CVE-2026-60004 exploit chain with no hidden steps.cve-2026-60004-poc.py:263-503
Command Execution
User-supplied --cmd argument is placed directly into the hook scriptThe hook payload is built by replacing CMD_PLACEHOLDER with the user's command; no hardcoded malicious command is present.cve-2026-60004-poc.py:122-145
Network Activity
HTTP requests only to the target Gitea instanceAll HTTP requests target the user-specified --url; no external callbacks, beacons, or data exfiltration to third parties.cve-2026-60004-poc.py:171-257
Review boundaries

What the analysis did not establish

  • One file (likely an image) was omitted from the evidence due to being non-text, but it is referenced in the README as a screenshot and is not required for classification.
  • The CVE record for CVE-2026-60004 was absent from the acquired CVEList, so external validation of the vulnerability details is not possible from the provided evidence alone.
  • One file (metadata-only) was omitted from the text evidence; its content is unknown but is not required for the backdoor review of the supplied readable files.
  • The review does not assess whether the exploit works as claimed or whether the target is actually vulnerable.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1