A critical security vulnerability, identified as CVE-2026-59774, has been discovered in Gitea, an open-source Git service. This flaw enables unauthenticated remote attackers to read arbitrary files on affected servers and potentially escalate to remote code execution. The issue impacts Gitea versions from 1.22.1 through 1.27.0 and has been addressed in version 1.27.1.
The vulnerability, documented as GHSA-6v53-hr58-556r, carries a Critical severity rating. Its CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation can occur remotely without authentication or user interaction, compromising confidentiality, integrity, and availability.
The flaw resides in Gitea’s repository markup-rendering feature. An attacker can send a crafted request to the POST /{owner}/{repo}/markup endpoint of a public repository. Since anonymous users can access this route when the repository is public and its code unit is enabled, the attacker does not need write access to the repository or an authenticated Gitea account.
By selecting the file rendering mode and submitting Org-mode content with an .org filename, the attacker can exploit the Org-mode renderer’s processing of the #+INCLUDE directive, which can point to an absolute file path.
In affected releases, Gitea initializes the go-org library without replacing its default file-reading callback. Consequently, the library accepts the supplied path and reads it directly, using the operating system’s file access permissions. This allows an attacker to retrieve files readable by the Gitea service account, including sensitive information such as the app.ini configuration file, deployment metadata, OAuth credentials, JWT-related secrets, database settings, and other locally accessible application material.
The GitHub advisory classifies this flaw as CWE-22 (path traversal), warning that it could lead to remote code execution if attackers use the exposed INTERNAL_TOKEN to inject a Git hook. A malicious hook may then run when an anonymous user clones a repository, executing attacker-controlled commands with the permissions of the Gitea operating-system user.
Gitea administrators are strongly advised to upgrade all affected deployments to version 1.27.1 or later. Organizations should also review logs for unusual requests to repository markup endpoints, especially those using Org-mode rendering, .org filenames, or suspicious include directives. After patching, security teams should rotate potentially exposed credentials, particularly internal tokens, OAuth secrets, JWT keys, database passwords, and integration credentials stored in app.ini.
This vulnerability underscores the importance of regular software updates and vigilant monitoring of open-source tools. As attackers increasingly target widely-used platforms, maintaining up-to-date systems and promptly addressing security advisories are crucial steps in safeguarding organizational assets.
