Gitea: Unauthenticated arbitrary file read via Org-mode INCLUDE directive
Summary
Gitea's Org-mode markup renderer processes INCLUDE directives in the repository markup endpoint without restricting access to server-side files. An unauthenticated attacker can use a suitable public repository to read files that the Gitea service account can access. If app.ini with its INTERNAL_TOKEN is disclosed, the attacker can chain the flaw with internal logger access to modify a Git hook and run commands as the Gitea service account.
Affected
- Gitea 1.22 up to but excluding 1.27.1 (vendor advisory range)
- Default configuration: unaffected
- Lower bound not fully verified; some sources list 1.22.1 as first affected release
Fixed in
- Gitea 1.27.1 (fixed by pull requests #38642 and #38645)
- Newer 1.27.x releases are available; use the latest stable 1.27.x release
Workaround
- No vendor-documented workaround known.
- Unknown whether disabling Org-mode rendering or restricting the markup route mitigates the issue.
Exploitation
- Public proof-of-concept code exists; maturity varies (some only demonstrate file read).
- Exploitation in the wild is not confirmed for this CVE.
- Not listed in the CISA Known Exploited Vulnerabilities catalog.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Upgrade internet-facing Gitea instances to the latest stable 1.27.x release immediately.
- Check whether the instance is reachable from the internet and whether affected versions are running.
- Review logs for requests to repository markup endpoints, especially Org-mode rendering and .org files.
- If compromise is suspected or the instance was exposed while vulnerable, rotate secrets in app.ini (INTERNAL_TOKEN, OAuth secrets, JWT keys, database and integration credentials) and check Git hooks for unauthorized changes.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (3 repositories)
FlowerWitch/CVE-2026-59774_docker · asvorg/CVE-2026-59774-poc · Ly0kha/CVE-2026-59774 - Metasploit module auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774 – Forgejo Arbitrary File Read via Org-mode Include
Research sources
- Gitea 1.27.1 release blog blog.gitea.com
- GHSA-6v53-hr58-556r security advisory github.com
- Gitea release v1.27.1 github.com
- Fix pull request #38642 github.com
- Fix pull request #38645 github.com
- OSS-security mailing list post www.openwall.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:58.
Original description (NVD)
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
NVD references (6)
- https://blog.gitea.com/release-of-1.27.1/
- https://github.com/go-gitea/gitea/pull/38642
- https://github.com/go-gitea/gitea/pull/38645
- https://github.com/go-gitea/gitea/releases/tag/v1.27.1
- https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r
- http://www.openwall.com/lists/oss-security/2026/08/10/3
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.