Critical Gitea Vulnerability Allows Arbitrary File Read and Potential RCE
A critical vulnerability in Gitea, CVE-2026-59774, allows unauthenticated attackers to read sensitive files and potentially achieve remote code execution.
A critical security flaw, identified as CVE-2026-59774, has been discovered in the popular open-source Git service Gitea, potentially exposing sensitive server information and enabling remote code execution. The vulnerability affects Gitea versions ranging from 1.22.1 through 1.27.0, with a fix available in version 1.27.1. The flaw has been assigned a Critical severity rating and a CVSS v3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high risk of exploitation due to its remote, unauthenticated, and user-interaction-free nature.
The vulnerability resides within Gitea's repository markup-rendering feature. Attackers can exploit this by sending a specially crafted request to the /{owner}/{repo}/markup endpoint. Crucially, this endpoint is accessible to unauthenticated users when the target repository is public and its code unit rendering is enabled. This bypasses the need for any prior access or authentication to the Gitea instance.
Exploitation involves submitting Org-mode content with an .org filename. The Org-mode renderer in Gitea processes the #+INCLUDE directive, which can be manipulated to point to an absolute file path on the server. In affected releases, Gitea initializes the go-org library without replacing its default file-reading callback. This allows the library to read any file that the Gitea service account has permissions to access.
Attackers can leverage this path traversal vulnerability to read highly sensitive files. These could include critical configuration files like app.ini, which often contains database credentials, API keys, and other deployment metadata. Other potential targets include OAuth credentials, JWT secrets, and any other application material stored locally and readable by the Gitea process.
The GitHub advisory, GHSA-6v53-hr58-556r, classifies the vulnerability under CWE-22 (Path Traversal). It further warns that the impact can escalate to remote code execution (RCE). This RCE is achievable if an attacker can exploit the exposure of an INTERNAL_TOKEN to inject a malicious Git hook. Such a hook could be triggered when an unauthenticated user clones a repository, allowing the attacker to execute arbitrary commands on the Gitea server with the privileges of the Gitea operating system user.
To mitigate this risk, Gitea administrators are strongly advised to immediately update all affected deployments to version 1.27.1 or a later patched release. Beyond patching, organizations should conduct thorough log reviews, searching for unusual requests to repository markup endpoints, particularly those employing Org-mode rendering or suspicious include directives. It is also recommended to rotate any credentials that may have been exposed, including internal tokens, OAuth secrets, JWT keys, and database passwords, especially if they were stored in app.ini.
This vulnerability highlights the ongoing risks associated with complex parsing features in web applications and the importance of secure default configurations. The ability for unauthenticated users to trigger file reads and potentially achieve RCE underscores the need for continuous security auditing and prompt patching of known vulnerabilities in widely used development platforms.