Critical Gitea CVE-2026-59774 Flaw Enables Arbitrary File Read and Remote Code Execution

A critical security vulnerability in Gitea has been disclosed that could allow unauthenticated remote attackers to read arbitrary files from vulnerable servers and potentially escalate the attack to remote code execution (RCE).

Tracked as CVE-2026-59774 and documented under security advisory GHSA-6v53-hr58-556r, the vulnerability affects Gitea versions 1.22.1 through 1.27.0.

The issue has been addressed in Gitea version 1.27.1, and administrators operating affected installations are strongly advised to upgrade immediately.

Critical Gitea CVE-2026-59774 Flaw

CVE-2026-59774 is considered particularly dangerous because exploitation reportedly requires no authentication, elevated privileges, or interaction from legitimate users.

The vulnerability has been assigned a Critical CVSS v3.1 severity rating with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

These characteristics make publicly accessible Gitea deployments attractive targets, especially development environments containing source code, credentials, deployment configurations, and other sensitive information.

The vulnerability originates in Gitea’s repository markup rendering functionality, specifically the POST /{owner}/{repo}/markup endpoint.

Although Gitea applies repository assignment and reader authorization checks to this route, anonymous users can reportedly satisfy those requirements when targeting a publicly readable repository with an appropriate code unit enabled.

Consequently, exploitation does not require the attacker to create an account, commit code, or obtain repository write privileges.

An attacker can send specially crafted markup content to the vulnerable endpoint and instruct Gitea’s generic renderer to process a file using the .org extension.

This causes the application to invoke its Org-mode rendering functionality, which depends on the go-org library. In Gitea 1.27.0, go-org is initialized through org.New() without overriding the library’s default file-reading callback.

In affected versions of the library, this callback ultimately relies on ioutil.ReadFile, creating the underlying arbitrary file-read condition.

The security weakness becomes exploitable through Org-mode’s #+INCLUDE directive. An attacker can supply an absolute filesystem path through this directive, causing the renderer to access the specified server-side file without properly restricting the request to an authorized directory.

The issue is categorized as CWE-22, Improper Limitation of a Pathname to a Restricted Directory, commonly associated with path traversal vulnerabilities.

According to Xbow Security’s analysis, attackers could leverage this behavior to retrieve any files readable by the operating-system account running Gitea.

Potential targets include Gitea’s app.ini configuration, internal authentication tokens, OAuth credentials, JWT signing material, infrastructure information, database credentials, and deployment secrets. Exposure of these resources could significantly expand the attack surface beyond basic information disclosure.

Of particular concern is Gitea’s INTERNAL_TOKEN, which may be stored within app.ini. The security advisory warns that obtaining this token could potentially enable attackers to access internal Gitea functionality and construct a more severe exploitation chain.

Researchers described a scenario where the compromised token could be used to inject a malicious Git hook through internal logger functionality.

The malicious hook could subsequently execute commands with the privileges of the Gitea operating-system user when an anonymous Git clone operation occurs, potentially transforming arbitrary file disclosure into full server compromise.

Organizations are potentially exposed when running Gitea versions 1.22.1 through 1.27.0 while hosting at least one publicly readable repository accessible through the affected markup functionality.

Administrators should upgrade immediately to Gitea 1.27.1 or later. Following remediation, security teams should rotate internal tokens, OAuth credentials, JWT signing keys, database passwords, and other secrets accessible to the Gitea service account.

Defenders should also investigate application and web-server logs for suspicious anonymous requests to repository markup endpoints, particularly activity involving Org-mode rendering or unusual file references.