## https://sploitus.com/exploit?id=C42A175E-00AB-597F-A4B9-CB36EA76C66F
# 🫖 CVE-2026-60004 — Gitea RCE PoC
> A direct, single-target validation tool for Gitea's `diffpatch` Git-hook remote code execution vulnerability.
[](https://www.python.org/)
[](LICENSE)
[](https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m)
This repository contains the focused AfterDark validator: **one script, one target, one run**. There are no discovery, reconnaissance, verification, or other subcommands.
## ⚠️ Legal and ethical disclaimer
This project is provided **only for authorized security testing, defensive validation, research, and education**. Use it exclusively on systems you own or have explicit written permission to assess.
The authors and contributors are not responsible for misuse, damage, service interruption, data loss, or legal consequences. You are responsible for following applicable laws, contracts, rules of engagement, and disclosure requirements.
This is an active RCE proof of concept. It creates an account, creates a private repository, writes a contract marker, and executes a command as the Gitea operating-system user. Treat it accordingly. 🛡️
## 🧠 Vulnerability summary
CVE-2026-60004 affects Gitea's repository `diffpatch` workflow. An attacker with repository write access can submit controlled patch content that installs and triggers a Git hook, resulting in command execution as the Gitea service account.
| Item | Detail |
| --- | --- |
| Product | Gitea |
| Affected versions | `>= 1.17.0, //
```
You can select a different root or exact run directory:
```bash
python3 scanner.py \
-c ENG-2026-001 \
-u audit-eng-2026-001 \
-p 'use-a-unique-disposable-password' \
--results-root ./engagement-evidence \
https://gitea.example
```
```bash
python3 scanner.py \
-c ENG-2026-001 \
-u audit-eng-2026-001 \
-p 'use-a-unique-disposable-password' \
--output-dir ./engagement-evidence/run-01 \
https://gitea.example
```
## 🧾 Evidence
Each run creates private `0600` files and refuses to overwrite existing results:
- `confirmation.json` — target, version result, account name, timestamps, command, return code, and captured artifacts
- `confirmation.command-output.txt` — complete remote command output
Evidence may contain sensitive engagement information. Do not commit it to Git. The included `.gitignore` excludes the default result paths and common evidence filenames.
## 🧹 Cleanup
The validator does not automatically delete server-side artifacts. After the assessment, an authorized administrator should:
- Delete the supplied disposable test account
- Delete the generated private `afterdark-*` repository
- Remove `/tmp/gitea-validation-/client.txt`
- Securely archive or delete local evidence
- Upgrade Gitea to `1.27.1` or later
- Perform a minimal remediation retest if permitted
A successful result proves command execution as the Gitea service account. It does **not** by itself prove root access, persistence, lateral movement, or complete host compromise.
## 🛡️ Built-in boundaries
- Direct execution with no operational subcommands
- One exact target per run
- No wildcard or target-file support
- Contract-correlated HTTP User-Agent and filesystem marker
- Version gate before active validation
- Mandatory operator-selected new account credentials
- Duplicate-account refusal
- Private repository creation
- Default command limited to `id`
- Private exclusive-create evidence files
- Password redaction from captured child output
- 180-second timeout for the default validation path
## ✅ Local tests
The tests exercise parsing and PoC construction without making network requests:
```bash
python3 -m unittest discover -s tests -v
```
## 🤝 Responsible contributions
Improvements that make the validator safer, more reliable, or easier to clean up are welcome. Do not submit real target details, credentials, private evidence, or destructive payloads.
For vulnerabilities in this tool, follow [SECURITY.md](SECURITY.md).
## 📚 References and credit
- [Official Gitea advisory: GHSA-rcr6-4jqh-j84m](https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m)
- [Gitea releases](https://github.com/go-gitea/gitea/releases)
- CVE reporter credited by the upstream advisory: **NightRang3r**
- Validator maintained by the **AfterDark Security Research Group**
---
Built for careful, contract-bound security validation. 🫖🛡️