A critical security vulnerability in Gitea, the self hosted Git platform, has been disclosed that allows unauthenticated attackers to read files accessible to the service account without requiring login credentials or repository write access. The flaw, tracked as CVE 2026 59774, affects Gitea versions 1.22.1 through 1.27.0 and has received a CVSS score of 9.8. According to the official advisory published on August 2, an attacker only needs access to a public repository and specially crafted Org Mode markup to exploit the issue. Gitea has addressed the vulnerability in version 1.27.1 and has advised cloud users that instances will be upgraded automatically during scheduled maintenance, while administrators of self hosted deployments are urged to update immediately.
The vulnerability exists in Gitea markup rendering endpoint, which processes POST requests to the repository markup function. Anonymous users can access this endpoint for public repositories where the code unit is enabled, allowing them to submit specially crafted Org Mode content. The issue stems from the Org Mode renderer in Gitea 1.27.0, where the application initialized the go org library without replacing its default ReadFile callback. In go org version 1.9.1, this callback relies on ioutil.ReadFile, allowing the Org Mode #+INCLUDE directive to access absolute file paths on the server. By submitting Org Mode markup in file mode, an attacker can retrieve any file that the Gitea service account has permission to read. Gitea resolved the issue through pull requests numbered 38642 and 38645 by overriding the ReadFile function so include paths are rendered as plain content rather than being resolved from the server file system. The update also includes a regression test to prevent similar issues in future releases.
Although the vulnerability does not directly provide remote code execution, Gitea stated that it could be combined with additional steps to achieve command execution. According to the advisory, an attacker could read the app.ini configuration file, obtain the INTERNAL_TOKEN, inject a Git hook through the internal logger, and trigger that hook during an anonymous clone operation. While this attack chain has been documented in Gitea advisory, no independently published exploit demonstrating the complete process has been identified. The company noted that upgrading to version 1.27.1 may not be sufficient if an affected system has already been exposed. Administrators are advised to review logs for anonymous requests to the markup endpoint, especially those involving Org Mode rendering or absolute file paths. If suspicious activity is detected, organizations should assume that credentials accessible to the Gitea service account may have been exposed and rotate the internal token, OAuth credentials, JWT signing material, and database credentials before considering the environment secure. Administrators should also inspect repository hook directories for unexpected executable files if there are signs that the escalation process was attempted.
The vulnerability was discovered by XBOW Security, an autonomous offensive security system, and triaged by Guido Leo, while Shai Rod, known online as NightRang3r, independently reported the same issue. Gitea stated that it has not observed evidence of active exploitation in the wild. As of August 5, 2026, CVE 2026 59774 had not been added to CISA Known Exploited Vulnerabilities catalog, although the file reading capability had been publicly discussed before the formal advisory was released. The disclosure follows several recent security updates for Gitea, including the June 2026 fix for the critical reverse proxy authentication bypass vulnerability tracked as CVE 2026 20896, which was reportedly probed by threat actors shortly after disclosure, and the May 2026 patch for CVE 2026 27771, a container registry access control vulnerability estimated to have affected more than 30,000 deployments across over 30 countries.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
