CVE-2026-60004 — Gitea diffpatch RCE

Remote code execution PoC for the Gitea diffpatch endpoint. An account with write access to a repository (on instances with open registration, simply registering an account suffices) can execute arbitrary shell commands on the server as the Gitea service account.

Vulnerability Summary

POST /api/v1/repos/{owner}/{repo}/diffpatch applies an attacker-controlled patch in a shared bare temporary clone repository:

git apply --index --recount --cached --binary   # Git ≥ 2.32 时追加 -3 三路合并回退

Attack chain: submitting the same patch twice → add/add conflict → the three-way merge fallback checks out the index paths (even with --cached) → in a bare repository root = $GIT_DIR, and the checked-out hooks/post-index-change (100755) becomes an active Git hook → Git automatically executes it when writing the index → RCE.

• CVSS: 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected: Gitea ≥ 1.17, < 1.27.1
• Fix: 1.27.1 (temporary clone changed from bare to non-bare, commit 470d34b1)
• Reported by: Shai Rod (NightRang3r)

Exploitation Requirements

• Write access to a repository; or the instance has open registration (default) → just register an account and create a repository
• Server-side Git ≥ 2.32 (enables the -3 three-way merge)
• diffpatch endpoint available

Usage

# 设置账户密码
export GITEA_PASSWORD='account-password'

python3 gitea_diffpatch_rce_poc.py \
  https://<gitea-base-url> \
  <username> \
  'id; uname -srm; pwd'

Requirements: Python 3 + a local git client.

PoC flow: authenticate → create a private initialized repository → craft a hooks/post-index-change patch → deliver it to diffpatch twice in a row (triggering an add/add conflict) → Git executes the hook → retrieve command output over authenticated Smart HTTP. No outbound callback; output is returned in-band.

⚠️ Disclaimer

For security research, vulnerability validation, and defensive testing only. This PoC creates repositories, submits patches, and triggers server-side command execution on the target instance. Run it only on your own test instance; do not use it against unauthorized or production environments.

Attribution & References

• Official advisory and PoC: GHSA-rcr6-4jqh-j84m (reported by Shai Rod / NightRang3r)
• Fix commit: 470d34b1
• Coverage: THN — New Gitea RCE Lets Repository Writers Execute Shell Commands