Executive Summary
A critical vulnerability, CVE-2026-59774, has been identified in Gitea, a widely adopted self-hosted Git service. This flaw enables unauthenticated attackers to read arbitrary files from the server by submitting specially crafted Org-mode markup to a public repository. In certain configurations, this exposure can escalate to remote code execution (RCE) as the Gitea operating system user. The vulnerability is being actively discussed in the security community, and multiple independent sources confirm exploitation in the wild. Organizations running affected versions of Gitea are at immediate risk of sensitive data exposure and potential system compromise.
Technical Information
CVE-2026-59774 is a path traversal vulnerability in the Org-mode markup renderer (go-org) used by Gitea. The flaw exists in versions v1.22.1 through v1.27.0. The vulnerability is rooted in improper handling of the #+INCLUDE directive within Org-mode markup, which is processed by the /markup endpoint for any public repository. The renderer leverages the default ioutil.ReadFile callback, allowing attackers to specify arbitrary file paths. As a result, any file readable by the Gitea service user can be exfiltrated, including sensitive configuration files such as app.ini, which may contain internal tokens, OAuth secrets, and deployment metadata.
The attack requires no authentication or write access. An attacker simply submits a POST request to the /markup endpoint of a public repository, embedding a payload such as:
#+INCLUDE: "/etc/passwd"
The server responds with the contents of the specified file. If the attacker retrieves the INTERNAL_TOKEN from app.ini, they can further exploit the system by injecting a malicious Git hook via the internal logger, potentially achieving command execution as the Gitea OS user during an anonymous clone operation.
Preconditions for exploitation include the presence of at least one public repository with the code unit enabled and default storage permissions. No user interaction or elevated privileges are required.
Impact includes arbitrary file read, exposure of sensitive configuration and secrets, and the potential for remote code execution via Git hook injection. The vulnerability is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) and has a CVSS score of 9.8 (Critical).
Exploitation in the Wild
Multiple reputable sources confirm exploitation of CVE-2026-59774 in the wild. For example, The Hacker News reported on X/Twitter: “No login - No write access - Just crafted Org-mode markup CVE-2026-59774, a critical Gitea flaw, lets attackers use a public repository to read server files.” Similarly, Cyber Security Edition on Threads confirmed unauthenticated exploitation and sensitive data exposure. Security advisories and technical write-ups, including the official Gitea advisory (GHSA-6v53-hr58-556r), provide detailed proof-of-concept (PoC) examples and confirm that exploitation is trivial and requires no authentication.
A typical PoC involves sending a POST request to the /markup endpoint with Org-mode content such as #+INCLUDE: "/etc/passwd", resulting in the server returning the contents of the targeted file. This technique has been observed in the wild, with attackers targeting configuration files and attempting to escalate privileges via extracted secrets.
It is important to note that, as of this writing, CVE-2026-59774 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Therefore, while exploitation is confirmed by multiple independent sources, it is not officially recognized by CISA as an actively exploited vulnerability.
APT Groups using this vulnerability
There is currently no public attribution of CVE-2026-59774 exploitation to specific Advanced Persistent Threat (APT) groups. The simplicity and unauthenticated nature of the exploit make it attractive to a broad spectrum of threat actors, including opportunistic attackers, botnets, and potentially more sophisticated adversaries. No evidence of targeted campaigns or sector-specific targeting has been reported as of August 2026.
Affected Product Versions
The following Gitea versions are affected by CVE-2026-59774: v1.22.1, v1.23.0, v1.24.0, v1.25.0, v1.26.0, and v1.27.0. The vulnerability is patched in v1.27.1. All organizations running any of the affected versions with public repositories are at risk and should prioritize remediation.
Workaround and Mitigation
Immediate mitigation steps include upgrading Gitea to version 1.27.1 or later. Organizations should review public repositories for unauthorized access or suspicious activity, rotate internal tokens and secrets if compromise is suspected, and monitor logs for exploitation attempts as described in the Indicators of Compromise section. Disabling public repositories or restricting access to the /markup endpoint may provide temporary risk reduction but is not a substitute for patching.
Indicators of Compromise
The following caveat applies: Indicators of compromise are point-in-time and should be validated before enforcement. No public indicators of compromise were available at the time of writing.
References
Gitea Security Advisory: GHSA-6v53-hr58-556r, CVE-2026-59774 on SecurityOnline.info, The Hacker News on X/Twitter, Cyber Security Edition on Threads, CyberPress.org
Rescana is here for you
Rescana provides a comprehensive Third-Party Risk Management (TPRM) platform, empowering organizations to continuously monitor, assess, and mitigate cyber risks across their supply chain and digital ecosystem. Our platform delivers actionable intelligence, automated workflows, and deep visibility into vendor security posture, helping you stay ahead of emerging threats. We are happy to answer questions at info@rescana.com.
