CVE-2026-60004 - Gitea <= 1.27.0 Pre-Auth RCE

This is a proof-of-concept exploit for CVE-2026-60004, a critical remote code execution vulnerability in Gitea versions 1.17 through 1.27.0. The script automates the full exploitation chain, from user registration to establishing a stable, interactive shell on the target server.

Background

The vulnerability exists in the /diffpatch API endpoint. By sending a malicious patch twice, an add/add collision triggers a three-way merge fallback that ignores the --cached flag and writes an executable Git hook directly into the bare repository's GIT_DIR. When Git updates the index, it automatically executes this hook, allowing arbitrary command execution as the Gitea service account.

Because Gitea is a compiled Go binary without an embedded PHP interpreter, dropping a traditional webshell often fails if there isn't a secondary web server configured to execute it. To solve this and ensure the exploit is completely stable, this script uses an API-driven approach:

1. It plants a post-index-change git hook via the diffpatch collision.
2. The hook reads a command from a tracked file (cmd.sh), executes it as the service account, and writes the output to a git blob ().