Gitea Flaw Allows Unauthenticated Arbitrary File Read

A critical security vulnerability in Gitea, a popular self-hosted Git platform, allows unauthenticated remote attackers to read arbitrary files from the server. The flaw, identified as CVE-2026-59774, poses a severe risk to any publicly accessible instance of the software.

The vulnerability affects Gitea versions 1.22.1 through 1.27.0 and carries a CVSS v3.1 score of 9.8. Attackers can send specially crafted markup content to the `POST /{owner}/{repo}/markup` endpoint, instructing Gitea’s generic renderer to process a file using the .org extension. By utilizing the `#+INCLUDE` directive with an absolute path, attackers can bypass directory restrictions and access any file readable by the Gitea service account.

The Technical Root Cause

The issue stems from how Gitea handles Org-mode markup rendering via the `go-org` library. In the affected versions, the library was initialized without overriding the default file-reading callback. This left the system reliant on `ioutil.ReadFile`, creating a path traversal condition categorized as CWE-22. Because this functionality is exposed through a public endpoint, the flaw can be triggered by anyone with access to a public repository, requiring no authentication or write permissions to execute.

Industry Implications

This vulnerability is particularly dangerous because it provides a direct path to total server compromise. The ability to read arbitrary files allows attackers to extract the `app.ini` configuration file, which contains highly sensitive data including database credentials, OAuth tokens, and JWT signing keys.

Security researchers note that the exposure of the `INTERNAL_TOKEN` from the configuration file is especially critical. This token could potentially be used to inject a malicious Git hook via internal logger functionality, escalating the arbitrary file read into full remote code execution (RCE) on the host machine.

Remediation and Next Steps

Gitea has released a fix for this vulnerability in version 1.27.1. Administrators of self-hosted Gitea instances are urged to update their installations immediately to prevent potential exploitation.

Organizations should verify that their instances are running the patched version and consider auditing their server logs for unusual POST requests to the markup endpoint. While the primary fix is available, the discovery of this flaw highlights the ongoing risks associated with third-party library integrations in self-hosted infrastructure.