gagaltotal/CVE-2026-60004-poc-gitea

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go program that exploits CVE-2026-60004, an authenticated or pre-auth RCE in Gitea, by injecting a malicious hook via the diffpatch API endpoint and optionally retrieving command output.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a single Go source file implementing a proof-of-concept exploit for CVE-2026-60004, a Gitea RCE vulnerability. The code performs the documented exploitation steps (detection, registration, repository creation, diffpatch delivery, and output retrieval) and contains no concealed, deceptive, or unrelated harmful behavior. All functionality is consistent with the stated purpose of demonstrating the vulnerability.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesGo
Target softwareGitea
Attack typesremote code executioncommand injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Go program that actively delivers a malicious payload to a remote Gitea instance to achieve remote code execution. The code constructs a diff patch containing a shell script, sends it to the diffpatch API endpoint, and retrieves the output of the executed command. This constitutes an exploit, not merely a scanner or writeup, as it performs the full exploitation chain including payload delivery and output retrieval.

cve-2026-60004-poc.go:707-759cve-2026-60004-poc.go:761-801README.md:5

Requirements

  • Target Gitea instance with open registration (for full-auto mode) or valid credentials (for semi-auto/manual modes).cve-2026-60004-poc.go:1040-1052cve-2026-60004-poc.go:1061-1072
  • Target must have the diffpatch API endpoint accessible and be running a vulnerable Gitea version (1.17–1.27.0).cve-2026-60004-poc.go:35-36cve-2026-60004-poc.go:1007-1008

Observed behavior

  • Registers a new user on the target Gitea instance when open registration is enabled.cve-2026-60004-poc.go:464-547
  • Creates a new repository under the authenticated user.cve-2026-60004-poc.go:549-618
  • Constructs a malicious diff patch containing a shell script hook that executes an arbitrary command and stores the output in a Git object.cve-2026-60004-poc.go:65-102
  • Sends the malicious diff patch to the /api/v1/repos/:owner/:repo/diffpatch endpoint to inject the hook.cve-2026-60004-poc.go:669-705
  • Retrieves the command output by fetching the raw 'proof' file from the rce-proof ref.cve-2026-60004-poc.go:761-801
  • Includes a non-intrusive check mode that detects Gitea, checks version, and probes the diffpatch endpoint without exploitation.cve-2026-60004-poc.go:986-1034
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Insecure Tls Configuration
InsecureSkipVerify: trueThe HTTP client disables TLS certificate verification, which is a security weakness but is explicitly documented in the README as intentional for testing compatibility. It does not constitute a backdoor.cve-2026-60004-poc.go:128-130README.md:102
Default Command
cat /etc/passwdThe default command executed on the target reads /etc/passwd, a common proof-of-concept action for RCE exploits. It is user-configurable and not hidden.cve-2026-60004-poc.go:878
Review boundaries

What the analysis did not establish

  • Evidence includes only two text files (README.md and cve-2026-60004-poc.go); three additional files (backup.txt, two images) are omitted or flagged as non-text media, but the main exploit logic is fully present.
  • CVE-2026-60004 record was absent from the acquired CVEList V5 dataset, so no external CVE description is available for cross-reference.
  • Three files from the repository (backup.txt, and two image files) were not included in the text evidence. The inventory describes them as notes and supporting images, but their content was not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1