Critical Gitea Flaw Lets Unauthenticated Attackers Read Server Files via Org-Mode Markup

A critical vulnerability in Gitea, the self-hosted Git platform, allows unauthenticated attackers to read arbitrary files accessible to the service account. Tracked as CVE-2026-59774 with a CVSS score of 9.8, the flaw affects versions 1.22.1 through 1.27.0 and is fixed in version 1.27.1.

The vulnerability resides in Gitea’s Org-mode renderer. When processing Org-mode markup with the #+INCLUDE directive, the renderer uses a default ReadFile callback that resolves absolute paths from the server filesystem. An attacker can craft a request to the POST /{owner}/{repo}/markup endpoint, which checks reader access but allows anonymous requests for public repositories. By submitting a malicious Org-mode document with Mode: file, the attacker can retrieve any file the Gitea service account can read.

While the flaw is not direct remote code execution, Gitea’s advisory describes a chain that could lead to command execution: an attacker reads app.ini to extract the INTERNAL_TOKEN, injects a Git hook via the internal logger, and triggers the hook during an anonymous clone. However, no independent exploit has been published.

Gitea has released version 1.27.1, which patches this vulnerability and also addresses CVE-2026-60004, a separate remote code execution bug. Cloud instances are being upgraded automatically, but self-hosted administrators should upgrade immediately. If exposure is suspected, rotate internal tokens, OAuth credentials, JWT signing keys, and database passwords.

The flaw was discovered by XBOW Security and independently reported by Shai Rod (NightRang3r). No exploitation in the wild has been reported, and the CVE is not yet on CISA’s Known Exploited Vulnerabilities catalog.