HackSpeak/CVE-2026-60004

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-60004 in Gitea to achieve remote code execution. It authenticates to a Gitea instance, creates a repository, and sends a crafted diffpatch payload twice to trigger a Git hook execution, then retrieves the command output.

Backdoor review

No backdoor observed in reviewed code

The PoC implements the documented CVE-2026-60004 exploit against Gitea diffpatch. It authenticates, creates a repo, sends a crafted patch twice to trigger a Git hook, and retrieves command output via the same Gitea instance. No concealed backdoor, unrelated payload, or operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareGitea
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional Python script that actively exploits a vulnerability to execute arbitrary shell commands on a remote Gitea server. It performs all steps of the attack chain: authentication, repository creation, payload delivery, and output retrieval. This is consistent with the definition of an exploit.

gitea_diffpatch_rce_poc.py:1-332README.md:3

Requirements

  • Write access to a repository on the target Gitea instance, or the instance must have open registration enabled.README.md:22-23
  • Target server must have Git version 2.32 or higher to enable the -3 three-way merge fallback.README.md:23
  • The diffpatch API endpoint must be available.README.md:24

Observed behavior

  • Authenticates to the Gitea instance using provided credentials.gitea_diffpatch_rce_poc.py:253-260
  • Creates a new private repository on the target instance.gitea_diffpatch_rce_poc.py:266-274
  • Constructs a malicious patch containing a post-index-change Git hook that executes the attacker-supplied shell command and stores the output in a Git object.gitea_diffpatch_rce_poc.py:120-144
  • Sends the malicious patch to the diffpatch endpoint twice to trigger an add/add conflict and force the checkout of the hook file.gitea_diffpatch_rce_poc.py:287-299
  • Fetches the command output from the repository using Git's smart HTTP protocol.gitea_diffpatch_rce_poc.py:175-195
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Sends crafted diffpatch payload to trigger post-index-change Git hook on target Gitea serverMatches the described CVE-2026-60004 attack chain; the hook executes the user-supplied command and stores output in the origin repository for retrieval.gitea_diffpatch_rce_poc.py:120-144gitea_diffpatch_rce_poc.py:276-299
Output Retrieval
Fetches command output from the target repository via authenticated Smart HTTPThe PoC retrieves the result of the executed command through the same Gitea instance, consistent with the README claim of in-band output retrieval.gitea_diffpatch_rce_poc.py:175-195gitea_diffpatch_rce_poc.py:301-303
Review boundaries

What the analysis did not establish

  • One file (unclassified, 1066 bytes) was omitted from the evidence and not analyzed.
  • The CVE record for CVE-2026-60004 was absent from the acquired CVEList V5 dataset.
  • One file (LICENSE) was omitted from the text evidence; its content is not reviewed.
  • Binary files were not present in the evidence.
  • The review is limited to the supplied text; no dynamic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1