Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup

An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.

The file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its formal advisory on August 2. Gitea 1.27.1 also patches CVE-2026-60004, a separate remote code execution bug covered in a prior THN report.

Gitea said Cloud instances would be upgraded automatically during the release maintenance window. Self-hosted administrators should move to 1.27.1 immediately.

The file-read bug is not direct one-request remote code execution. Gitea says it can become command execution if an attacker reads app.ini, extracts INTERNAL_TOKEN, injects a Git hook through the internal logger, and triggers that hook during an anonymous clone.

That chain is described in Gitea’s advisory; The Hacker News found no independently published exploit demonstrating it.

Upgrading is necessary but may not be sufficient after suspected exposure. If logs show the markup endpoint was reached on an affected build, treat credentials readable by the Gitea service account as exposed and rotate the internal token, OAuth material, JWT signing material, and database credentials before considering the instance clean.

No badge required

The file-read path runs through Gitea’s markup rendering endpoint, POST /{owner}/{repo}/markup. The route allows optional sign-in, resolves the repository, and checks reader access. An anonymous request clears that check against any public repository with its code unit enabled. That precondition limits the unauthenticated exposure: an instance with no public repositories has no anonymous attack path through this endpoint.

The break is in Gitea’s Org-mode renderer. Gitea 1.27.0 initialized go-org with org.New() and did not replace the library’s default ReadFile callback. In go-org 1.9.1, that callback is ioutil.ReadFile. Org-mode’s #+INCLUDE directive accepts absolute paths and passes them to the callback. An attacker submits Org-mode markup, selects Mode: file, and receives files the service account can read.

The fix landed in PR #38642 and was backported in PR #38645. Gitea now overrides ReadFile so an Org-mode include path is returned as plain rendered content instead of being resolved from the server filesystem. The patch added a regression test for include-path rendering.