Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Gitea may leak files and run commands

CVE-2026-59774 · published 1 day ago
Summary

Gitea’s document renderer can read any file the service can access when processing INCLUDE directives in public repositories. An attacker could view sensitive configuration files and, if they contain a token, use it to alter a Git hook and execute commands as the Gitea service account. Apply the latest Gitea update or restrict the renderer to prevent file inclusion.

What to do
  • Update gitea gitea to version 1.27.1 or later.
Affected software
VendorProductAffected versions
gitea gitea < 1.27.1
Original advisory text
Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
28% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-59774 · NVD
CVE-2026-59774 · MITRE
CVE-2026-59774 · OSV
GHSA-6v53-hr58-556r · GHSA
Track software like this
Free during beta