0xBlackash/CVE-2026-60004

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-60004 in Gitea by crafting a malicious diff patch containing a Git hook, submitting it to the /diffpatch API endpoint, and retrieving the executed command output via a smart HTTP fetch.

Backdoor review

No backdoor observed in reviewed code

The PoC is a single Python script that exploits CVE-2026-60004 by sending crafted diff patches to a Gitea instance to install and execute a Git hook. The hook runs the user-supplied shell command and returns the output. No concealed backdoor, unrelated payload, or deceptive behavior was observed. The script's actions are limited to the declared exploit flow: authentication, repository creation, patch submission, and output retrieval.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareGitea
Attack typesRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively exploits the vulnerability by crafting and delivering a malicious payload (Git hook) to the target, triggering its execution, and retrieving the results. It does not merely detect or report the vulnerability; it exercises it to achieve remote code execution.

CVE-2026-60004.py:139-163CVE-2026-60004.py:303-312CVE-2026-60004.py:315-323

Requirements

  • Authenticated Gitea user with repository write accessCVE-2026-60004.py:10-11
  • Target Gitea instance must be vulnerable (versions 1.17 to <1.27.1)CVE-2026-60004.py:18
  • Git executable must be available on the attacker's machineCVE-2026-60004.py:251-253

Observed behavior

  • Authenticates to the Gitea instance using provided credentialsCVE-2026-60004.py:276-284
  • Creates a new private repository on the target Gitea instanceCVE-2026-60004.py:287-297
  • Constructs a malicious Git hook (post-index-change) that executes an attacker-supplied shell command and stores the output in a Git objectCVE-2026-60004.py:139-163
  • Generates a diff patch that introduces the malicious hook fileCVE-2026-60004.py:165-175
  • Submits the malicious patch twice to the /diffpatch API endpoint to trigger the vulnerabilityCVE-2026-60004.py:303-312
  • Fetches the command output from the target repository using Git smart HTTP protocolCVE-2026-60004.py:194-214
  • Displays the executed command output and exit status to the attackerCVE-2026-60004.py:315-323
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
The script builds a Git hook containing a user-supplied shell command, wraps it in a diff patch, and submits it twice to the /api/v1/repos/{owner}/{repo}/diffpatch endpoint to trigger hook installation and execution.This is the declared exploit behavior for CVE-2026-60004 and matches the vulnerability description.CVE-2026-60004.py:139-163CVE-2026-60004.py:165-175CVE-2026-60004.py:303-311
Output Retrieval
The script fetches command output by cloning the target repository via smart HTTP and reading a blob referenced by a known ref.This is the standard method for retrieving the result of the executed command and is consistent with the exploit's purpose.CVE-2026-60004.py:194-214CVE-2026-60004.py:314-317
Network Communication
The script communicates only with the user-specified Gitea base URL using the Gitea API and smart HTTP protocol.No external or unrelated network endpoints are contacted.CVE-2026-60004.py:87-132CVE-2026-60004.py:196-200
Review boundaries

What the analysis did not establish

  • CVE-2026-60004 record was absent from the acquired CVEList V5 dataset, so CVE metadata could not be independently verified.
  • Only the two text files (Python script and README) were provided; no binary or configuration files were included.
  • The analysis is based solely on static review of the provided source code; the code was not executed, and its behavior was not dynamically verified.
  • Review is limited to the supplied text files; no binary or non-text content was present in the evidence.
  • The script's behavior depends on the Gitea version and configuration; the review does not verify the exploit's effectiveness or safety.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1