## https://sploitus.com/exploit?id=C6E8CD3F-4284-53AC-8BC8-E32DE1F90F1C
# CVE-2026-60004 — Gitea `diffpatch` RCE
The `diffpatch` endpoint of Gitea allows for remote code execution. Accounts with write permissions to repositories (anonymous registration is sufficient) can execute arbitrary shell commands using the **Gitea service account** on the server.
## Description of the Vulnerability
The `POST /api/v1/repos/{owner}/{repo}/diffpatch` endpoint applies a patch in a shared **bare temporary clone repository**. The patch is applied using the following command:
```bash
git apply --index --recount --cached --binary
# Append "-3" for three-way merge operations when Git version ≥ 2.32
```
In an attack chain, the same patch can be submitted twice, leading to an `add/add` conflict. The three-way merge then extracts the index path (even if `--cached` is used). The `hooks/post-index-change` file created in the bare repository becomes active as a Git hook. When Git generates the index, this hook is executed, resulting in a **RCE** vulnerability.
- **CVSS**: 9.8 (Critical), `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
- **Affected Systems**: Gitea ≥ 1.17
- **Command**: `id; uname -srm; pwd`
## Parameters
- `url`: Base URL of Gitea
- `username`: Existing Gitea username (default: open registration)
- `command`: Arbitrary shell command to execute on the target
- `GITEA_PASSWORD`: Account password (environment variable or entered interactively)
### Requirements
Python 3 and the local `git` client are required. The process involves authentication, creating a private initialization repository, generating the `hooks/post-index-change` patch, submitting it to `diffpatch` twice (triggering an `add/add` conflict), executing the hook via Git, and retrieving the command output through authenticated Smart HTTP. No outbound callbacks are allowed; the output is sent within the system.
## ⚠️ Disclaimer
This experiment is intended only for security research, vulnerability validation, and defensive testing. This PoC involves creating repositories, submitting patches, and executing server-side commands on target instances. Please run this experiment on self-built test instances only. Do not use it in unauthorized or production environments.
## References
- Official announcement and PoC: [GHSA-rcr6-4jqh-j84m](https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m) (Reporter: Shai Rod / NightRang3r)
- Fix commit: [470d34b1](https://github.com/go-gitea/gitea/commit/470d34b1de87d901bd9135564d5ee18c0d339e82)
- Report: [THN — New Gitea RCE Lets Repository Writers Execute Shell Commands](https://thehackernews.com/2026/07/new-gitea-rce-lets-repository-writers.html)
[source-iocs-preserved const=GIT_DIR]