🧠 Vulnerability summary

CVE-2026-60004 affects Gitea's repository diffpatch workflow. An attacker with repository write access can submit controlled patch content that installs and triggers a Git hook, resulting in command execution as the Gitea service account.

Forgejo and other forks require manual implementation review and are not automatically treated as affected.

✨ What the script does

Every run performs one fixed workflow:

1. Normalizes one exact HTTP or HTTPS target.
2. Checks the reported Gitea version and blocks known non-affected releases.
3. Requires an operator-supplied contract number, username, and password.
4. Refuses to reuse an account that already authenticates.
5. Attempts to register exactly the supplied test account.
6. Creates a uniquely named private repository.
7. Installs and triggers the crafted post-index-change hook through diffpatch.
8. Writes the contract marker and runs id by default.
9. Retrieves command output through a temporary Git reference.
10. Saves local JSON evidence and full command output.

The tool accepts only a single target. It has no target-list, wildcard, mass-scan, or passive-discovery mode.

📦 Requirements

• Python 3.10 or newer
• Git available in PATH
• Explicit written authorization for the selected target
• Gitea self-registration enabled
• A brand-new disposable username and password for the run

The script uses only Python's standard library. No pip install is required.

🚀 Install

🧪 Usage

Short options are also available:

🚨 The password is supplied on the command line and displayed in the final result panel. Use only a unique disposable test credential. Be aware that command-line arguments may be retained in shell history or temporarily visible to local process-inspection tools.

Custom authorized command

The default command is id. A narrowly scoped custom command can be supplied with --cmd:

Custom commands intentionally have no timeout. The validator waits until the remote command exits, so avoid interactive or long-running commands unless the engagement specifically requires them.

Output location

By default, each run writes beneath:

You can select a different root or exact run directory:

🧾 Evidence

Each run creates private 0600 files and refuses to overwrite existing results:

• confirmation.json — target, version result, account name, timestamps, command, return code, and captured artifacts
• confirmation.command-output.txt — complete remote command output

Evidence may contain sensitive engagement information. Do not commit it to Git. The included .gitignore excludes the default result paths and common evidence filenames.

🧹 Cleanup

The validator does not automatically delete server-side artifacts. After the assessment, an authorized administrator should:

• Delete the supplied disposable test account
• Delete the generated private afterdark-* repository
• Remove /tmp/gitea-validation-<contract>/client.txt
• Securely archive or delete local evidence
• Upgrade Gitea to 1.27.1 or later
• Perform a minimal remediation retest if permitted

A successful result proves command execution as the Gitea service account. It does not by itself prove root access, persistence, lateral movement, or complete host compromise.

🛡️ Built-in boundaries

• Direct execution with no operational subcommands
• One exact target per run
• No wildcard or target-file support
• Contract-correlated HTTP User-Agent and filesystem marker
• Version gate before active validation
• Mandatory operator-selected new account credentials
• Duplicate-account refusal
• Private repository creation
• Default command limited to id
• Private exclusive-create evidence files
• Password redaction from captured child output
• 180-second timeout for the default validation path

✅ Local tests

The tests exercise parsing and PoC construction without making network requests:

🤝 Responsible contributions

Improvements that make the validator safer, more reliable, or easier to clean up are welcome. Do not submit real target details, credentials, private evidence, or destructive payloads.

For vulnerabilities in this tool, follow SECURITY.md.

📚 References and credit

• Official Gitea advisory: GHSA-rcr6-4jqh-j84m
• Gitea releases
• CVE reporter credited by the upstream advisory: NightRang3r
• Validator maintained by the AfterDark Security Research Group

Built for careful, contract-bound security validation. 🫖🛡️