Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
Summary: An unauthenticated attacker can read any file the Gitea service account can access in versions 1.22.1 through 1.27.0 using only a public repository and crafted Org-mode markup, with no login or write access required; the flaw is tracked as CVE-2026-59774, rated Critical at CVSS 9.8, and fixed in Gitea 1.27.1. The break is in the Org-mode renderer: Gitea 1.27.0 initialized go-org with org.New() without replacing the library's default ReadFile callback, so the #+INCLUDE directive accepts absolute paths and returns files the service account can read.
What you should know: Gitea's advisory describes a chain from reading app.ini to extracting INTERNAL_TOKEN, injecting a Git hook through the internal logger, and triggering it during an anonymous clone - so a file read can become command execution, and any instance with a public repository exposes the endpoint to anonymous requests.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-20896CVE-2026-27771CVE-2026-59774CVE-2026-60004
- Related
- CVE-2026-60004: Gitea Code Injection Vulnerability Known Exploited Vulnerabilities · Aug 25, 2026