CVE-2026-59774 — Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attac…
Published: 2026-10-14 · CVSS: 9.8 · CVSS 3.1
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7