Critical Gitea Vulnerability (CVE-2026-59774) Exposes Servers to Remote Code Execution
A severe vulnerability in Gitea, tracked as CVE-2026-59774, allows unauthenticated attackers to read arbitrary files on vulnerable servers and potentially achieve remote code execution (RCE). The flaw, disclosed under GHSA-6v53-hr58-556r, affects Gitea versions 1.22.1 through 1.27.0 and has been patched in version 1.27.1.
With a CVSS v3.1 score of 9.8 (Critical), the vulnerability requires no authentication, user interaction, or elevated privileges, making internet-exposed Gitea instances particularly high-risk. The issue stems from Gitea’s repository markup rendering endpoint (POST /{owner}/{repo}/markup), where anonymous users can exploit public repositories with readable code units enabled.
Attackers can submit Org-mode markup data with an .org filename, triggering Gitea’s go-org library which, in affected versions, uses ioutil.ReadFile without proper path restrictions. The #+INCLUDE directive in Org-mode allows absolute filesystem paths, enabling attackers to read files accessible to the Gitea service account, including:
app.iniconfiguration files- Internal bearer tokens
- OAuth/JWT signing keys
- Server-side secrets
Exfiltrating Gitea’s INTERNAL_TOKEN could escalate the attack further, allowing interaction with internal Gitea functions and injection of malicious Git hooks. When an anonymous Git clone is performed, these hooks could execute commands as the Gitea OS user, leading to full server compromise.
The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Organizations are vulnerable if they run an affected Gitea version and host at least one publicly readable repository with a code unit accepted by the markup route. Standard Gitea storage permissions may also allow the service account to modify global Git configurations, increasing RCE risks.
Mitigation involves upgrading to Gitea 1.27.1 or later and rotating exposed secrets, including internal tokens, OAuth credentials, and JWT keys. Security teams should also review logs for unusual anonymous requests to markup endpoints, particularly those involving Org-mode rendering.
Source: https://cyberpress.org/critical-gitea-vulnerability-exposed/
Gitea TPRM report: https://www.rankiteo.com/company/ganasec
"id": "gan1785839090",
"linkid": "ganasec",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Organizations running Gitea '
'versions 1.22.1 through 1.27.0 '
'with publicly readable '
'repositories',
'industry': 'Technology/Version Control',
'name': 'Gitea',
'type': 'Software Provider'}],
'attack_vector': 'Remote',
'data_breach': {'data_exfiltration': 'Possible via arbitrary file read',
'file_types_exposed': ['.org (Org-mode markup)',
'app.ini',
'Git hooks'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Configuration files',
'Internal bearer tokens',
'OAuth/JWT signing keys',
'Server-side secrets']},
'description': 'A severe vulnerability in Gitea, tracked as CVE-2026-59774, '
'allows unauthenticated attackers to read arbitrary files on '
'vulnerable servers and potentially achieve remote code '
'execution (RCE). The flaw affects Gitea versions 1.22.1 '
'through 1.27.0 and has been patched in version 1.27.1. The '
'issue stems from Gitea’s repository markup rendering '
'endpoint, where anonymous users can exploit public '
'repositories with readable code units enabled. Attackers can '
'submit Org-mode markup data with an .org filename, triggering '
'Gitea’s go-org library to read files accessible to the Gitea '
'service account, including app.ini configuration files, '
'internal bearer tokens, OAuth/JWT signing keys, and '
'server-side secrets. Exfiltrating Gitea’s INTERNAL_TOKEN '
'could escalate the attack further, leading to full server '
'compromise.',
'impact': {'data_compromised': 'Arbitrary files (e.g., app.ini, internal '
'tokens, OAuth/JWT keys, server-side secrets)',
'operational_impact': 'Potential full server compromise via remote '
'code execution',
'systems_affected': 'Gitea servers (versions 1.22.1 through '
'1.27.0)'},
'post_incident_analysis': {'corrective_actions': 'Patch vulnerability, rotate '
'secrets, and implement '
'enhanced logging for markup '
'endpoints.',
'root_causes': 'Improper limitation of a pathname '
'to a restricted directory (CWE-22) '
'in Gitea’s go-org library, '
'allowing arbitrary file read via '
'Org-mode markup.'},
'recommendations': 'Upgrade to Gitea 1.27.1 or later, rotate exposed secrets, '
'and monitor logs for suspicious activity.',
'references': [{'source': 'GitHub Advisory Database',
'url': 'https://github.com/advisories/GHSA-6v53-hr58-556r'}],
'response': {'containment_measures': 'Upgrade to Gitea 1.27.1 or later',
'enhanced_monitoring': 'Review logs for unusual anonymous '
'requests to markup endpoints',
'remediation_measures': 'Rotate exposed secrets (internal '
'tokens, OAuth credentials, JWT keys)'},
'title': 'Critical Gitea Vulnerability (CVE-2026-59774) Exposes Servers to '
'Remote Code Execution',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-59774 (GHSA-6v53-hr58-556r)'}