## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-EQSTLAB-CVE-2026-60004
# CVE-2026-60004 Gitea diffpatch RCE
★ CVE-2026-60004 Gitea `diffpatch` Git Hook RCE PoC ★
# Overview
> **CVE-2026-60004** is a **Remote Code Execution (RCE)** vulnerability in **Gitea**. The `diffpatch` API applies a supplied patch with `git apply --cached`, which should only update the index and never write files to disk. By sending the **same patch twice** , an attacker can force an add/add collision that triggers Git's **three-way merge fallback (`-3`)**. This path ignores `--cached` and checks the file out to the working tree. Because the temporary clone is **bare** , its working tree root is `$GIT_DIR`. A patch that creates an executable `hooks/post-index-change` therefore installs a live Git hook. Git executes the hook on the next index update, allowing commands to run as the Gitea service account. The endpoint requires repository write access. If registration is open, a user can register an account, create a repository, and reach the vulnerable code path.