Full Report
An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1. The file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its
Analysis Summary
# Vulnerability: Unauthenticated Arbitrary File Read in Gitea Org-Mode Renderer
## CVE Details
- **CVE ID:** CVE-2026-59774
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Not explicitly mentioned (typically CWE-22: Improper Limitation of a Pathname to a Restricted Directory or CWE-200: Exposure of Sensitive Information)
## Affected Systems
- **Products:** Gitea (Self-hosted Git platform)
- **Versions:** 1.22.1 through 1.27.0
- **Configurations:** Instances with at least one public repository that has the "code unit" enabled. Instances with no public repositories are not reachable via the unauthenticated path.
## Vulnerability Description
The flaw exists in Gitea's Org-mode markup rendering logic. Gitea utilized the `go-org` library but failed to override the default `ReadFile` callback. In the library version used, this callback defaults to `ioutil.ReadFile`. An attacker can use the Org-mode `#+INCLUDE` directive with absolute filesystem paths. When the Gitea `POST /{owner}/{repo}/markup` endpoint is called with Org-mode selected, the server resolves and returns the contents of any file accessible to the Gitea service account.
## Exploitation
- **Status:** PoC details available in advisory; no confirmed exploitation in the wild (as of August 5, 2026).
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** Total. Attackers can read sensitive configuration files (e.g., `app.ini`).
- **Integrity:** High. While the flaw is a "read" primitive, it can be escalated to Remote Code Execution (RCE) if an attacker retrieves the `INTERNAL_TOKEN` and injects Git hooks.
- **Availability:** High (via the RCE escalation path).
## Remediation
### Patches
- **Gitea 1.27.1:** This version contains the fix that overrides the `ReadFile` callback to prevent local filesystem access.
### Workarounds
- **Disable Public Repositories:** Restricting the instance to private repositories only removes the unauthenticated attack vector.
- **Disable Org-Mode:** If not required, disabling Org-mode rendering can mitigate the risk.
## Detection
- **Log Analysis:** Review HTTP server logs for suspicious `POST` requests to `/{owner}/{repo}/markup` where the payload contains `#+INCLUDE` or absolute file paths.
- **Integrity Checks:** If compromise is suspected, inspect repository hook directories for unauthorized executable files.
- **Credential Rotation:** If logs indicate the markup endpoint was accessed by an unauthorized party, rotate the following:
- Internal tokens (`INTERNAL_TOKEN`)
- OAuth and JWT signing materials
- Database credentials
## References
- **Gitea Security Advisory:** hxxps[://]github[.]com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r
- **The Hacker News Report:** hxxps[://]thehackernews[.]com/2026/08/critical-gitea-flaw-let-unauthenticated.html
- **Vendor PR Fix:** hxxps[://]github[.]com/go-gitea/gitea/pull/38642