CVE-2026-59774

9.8Critical

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-22

Impact

Unauthenticated remote attackers can read arbitrary server files and achieve remote code execution as the Gitea service user. They only need network access to render an Org-mode file in a public repository.

Root cause

The Org-mode markup renderer processes INCLUDE directives without restricting access to local server-side files, leading to directory traversal.

Affected systems

Gitea versions prior to 1.27.1.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to Gitea 1.27.1 or later immediately. If you cannot upgrade right away, restrict public repository creation or disable Org-mode markup rendering.

shell

$ gitea --version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-59774