A critical security vulnerability has been identified in Gitea, the widely used self-hosted Git platform, affecting versions 1.22.1 through 1.27.0. This flaw allows unauthenticated attackers to read any file accessible to the Gitea service account by exploiting the Org-mode markup rendering feature. The issue has been addressed in the recently released Gitea version 1.27.1.
Designated as CVE-2026-59774, this vulnerability carries a CVSS score of 9.8, indicating its severity. The problem arises from Gitea’s handling of Org-mode’s #+INCLUDE directive, which permits the inclusion of external files into documents. In the affected versions, Gitea’s Org-mode renderer utilized the default ReadFile callback from the go-org library, allowing attackers to submit specially crafted Org-mode markup that could access and read arbitrary files on the server.
To exploit this vulnerability, an attacker needs access to a public repository with the code unit enabled. By submitting a malicious Org-mode file and selecting the ‘file’ mode, the attacker can retrieve the contents of any file that the Gitea service account has permission to read. This could potentially expose sensitive information, including configuration files and credentials.
While the vulnerability primarily facilitates unauthorized file reading, there is a potential escalation path to remote code execution. An attacker could read Gitea’s app.ini file to extract the INTERNAL_TOKEN, inject a malicious Git hook through the internal logger, and trigger that hook during an anonymous clone operation. This chain of actions could lead to command execution on the server.
Gitea has released version 1.27.1 to address this issue. The update overrides the ReadFile callback in the Org-mode renderer, ensuring that include paths are rendered as plain text rather than being resolved from the server’s filesystem. Administrators are strongly advised to upgrade to this version immediately to mitigate the risk.
For those managing self-hosted instances, it’s crucial to review server logs for any anonymous POST requests to the /{owner}/{repo}/markup endpoint, especially those involving Org-mode rendering or absolute filesystem paths. If such activity is detected, it’s recommended to rotate internal tokens, OAuth credentials, JWT signing materials, and database credentials to prevent potential exploitation.
As of August 5, 2026, there have been no reports of this vulnerability being exploited in the wild. However, given the severity and the potential for unauthorized access to sensitive information, prompt action is essential to secure affected Gitea instances.
This incident underscores the importance of rigorous input validation and the need for continuous security assessments in software development. Organizations should remain vigilant, regularly update their systems, and monitor for unusual activities to safeguard against emerging threats.
