Full research report
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
Executive assessment
CVE-2026-59774 is a critical (CVSS 9.8) unauthenticated arbitrary file-read in Gitea's Org-mode markup renderer, patched in version 1.27.1 on 2 August 2026. The root cause — an unoverridden ioutil.ReadFile callback in the go-org library — allowed Org-mode #+INCLUDE directives to resolve absolute server filesystem paths through the publicly accessible markup rendering endpoint, with exposure limited to instances hosting public repositories. Where app.ini is readable by the service account, the vulnerability can surface INTERNAL_TOKEN and other high-value secrets. Gitea's advisory describes a further escalation to remote code execution via hook injection, but this chain is single-sourced to the vendor advisory with no independent validation found. The vulnerability is part of a sustained 2026 pattern of critical Gitea security issues — including CVE-2026-20896 (Docker auth bypass with confirmed active exploitation within 13 days of disclosure) and CVE-2026-27771 (container registry flaw estimated to affect over 30,000 deployments) — underscoring the need for prompt remediation given demonstrated attacker interest in the platform.
What happened
Gitea released version 1.27.1 on 2 August 2026, patching CVE-2026-59774, a critical unauthenticated arbitrary file-read vulnerability (CVSS 9.8) affecting versions 1.22.1 through 1.27.0. The flaw lies in Gitea's Org-mode markup renderer, which failed to override the go-org library's default ioutil.ReadFile callback, permitting #+INCLUDE directives to resolve absolute server filesystem paths. XBOW Security's autonomous offensive security system discovered the vulnerability (triaged by Guido Leo); Shai Rod (NightRang3r) independently reported the same issue. As of 5 August 2026, no exploitation in the wild has been confirmed and CVE-2026-59774 has not appeared on CISA's Known Exploited Vulnerabilities catalogue.
Affected scope
All self-hosted Gitea instances running versions 1.22.1 through 1.27.0 with at least one public repository whose code unit is enabled. Instances with no public repositories have no anonymous attack path through the affected endpoint. Gitea Cloud instances are upgraded automatically; self-hosted administrators must apply 1.27.1 manually. Exposure is most consequential where the Gitea service account can read app.ini, as this would surface INTERNAL_TOKEN and other sensitive credentials.
Technical assessment
The markup rendering endpoint POST /{owner}/{repo}/markup permits unauthenticated access against public repositories with the code unit enabled. Gitea 1.27.0 initialised the go-org library using org.New() without overriding the default ReadFile callback, which in go-org 1.9.1 is ioutil.ReadFile and accepts absolute filesystem paths without restriction. An attacker submits Org-mode markup containing a #+INCLUDE directive with an absolute path and selects Mode: file, causing the renderer to return the targeted file's contents. The fix, implemented in PR #38642 and backported in PR #38645, overrides the ReadFile callback to return include-path content as literal rendered text rather than resolving it from the filesystem. Gitea's advisory further describes a multi-step escalation path — INTERNAL_TOKEN extraction from app.ini, Git hook injection via the internal logger, and hook execution during an anonymous clone — that could result in remote code execution, but this chain is single-sourced to Gitea's advisory and no independently published exploit demonstrating it has been identified.
Recommended defensive actions
- Patch all self-hosted Gitea instances to version 1.27.1 immediately.
- Rotate the Gitea INTERNAL_TOKEN, OAuth credentials, JWT signing material, and database passwords if the markup endpoint was reachable on an affected build.
- Review access logs for anonymous POST requests to /{owner}/{repo}/markup, particularly those selecting Org-mode rendering or containing absolute filesystem paths in the request body.
- Inspect repository hook directories for unexpected or unauthorised executable files if log review suggests the advisory's escalation path may have been attempted.
- Subscribe to Gitea's security advisories to receive timely notification of future vulnerabilities.
Uncertainties and evidence gaps
- The multi-step token-to-hook RCE escalation path is single-sourced to Gitea's advisory; no independent researcher has publicly validated or demonstrated this chain.
- The nature and scope of the 'public preview' of the file-read primitive before the formal advisory is not detailed in any available source.
- No public scan or exposure estimate has been published for CVE-2026-59774, so the total number of vulnerable self-hosted instances is unknown.
- CyberSecurityNews cites a CVSS score of 9.9 while the GitHub advisory records 9.8; the discrepancy is minor but unresolved across published sources.
- The supplied reporting identifies CVE-2026-60004, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No exploitation in the wild confirmed for CVE-2026-59774 as of 5 August 2026; not listed on CISA's Known Exploited Vulnerabilities catalogue; the file-read primitive was publicly previewed before the formal advisory, but no independently published exploit has been identified.
Investigation began with the THN source article identifying CVE-2026-59774 as a critical unauthenticated file-read in Gitea's Org-mode renderer. The Gitea 1.27.1 release blog and GitHub advisory GHSA-6v53-hr58-556r corroborated the technical root cause, patch details, and researcher credits as primary vendor sources. CyberSecurityNews provided independent corroboration from a second domain, with a minor CVSS discrepancy noted. BleepingComputer's reporting on prior CVE-2026-20896 active exploitation established the broader attacker interest in Gitea. No independently verified public PoC or technical write-up for the CVE-2026-59774 RCE escalation chain was found across all searches.
- What are the confirmed technical details, CVE metadata, and exploitation status for this vulnerability?Fetched the THN primary source articlethehackernews.com ↗
Confirmed CVE-2026-59774 (CVSS 9.8), affected versions 1.22.1–1.27.0, root cause in unoverridden go-org ioutil.ReadFile callback, PR #38642 patch, XBOW Security discovery (Guido Leo), independent report by Shai Rod (NightRang3r), no exploitation in the wild as of 5 August 2026
why Provides the initial factual basis but treated as untrusted reporting requiring corroboration from primary vendor and advisory sources
- Does the Gitea vendor blog confirm the patch details and CVE scope?Fetched the Gitea 1.27.1 official release blogblog.gitea.com ↗
Confirmed CVE-2026-59774 (arbitrary file read via Org-mode #+INCLUDE, fixed by PRs #38642 and #38645) and CVE-2026-60004 (RCE via diffpatch API, fixed by PRs #38637 and #38638) both patched in 1.27.1; developer and reporter credits verified
why Vendor-authoritative source confirming the patch is real and scoping the 1.27.1 security release; narrows affected version range to 1.22.1–1.27.0
- What does the formal security advisory reveal about vulnerability classification and timeline?Fetched GitHub advisory GHSA-6v53-hr58-556rgithub.com ↗
Advisory published 2 August 2026; CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CWE-22 (Path Traversal); discoverer XBOW Security (Guido Leo); independent reporter NightRang3r
why Authoritative primary advisory confirming all key vulnerability metadata, researcher credits, and CWE classification
- Does an independent security outlet corroborate the technical root cause and advisory reference?Fetched CyberSecurityNews article on CVE-2026-59774cybersecuritynews.com ↗
Confirms technical root cause, GHSA-6v53-hr58-556r reference, and RCE escalation path; cites CVSS 9.9 vs advisory's 9.8 — minor unresolved discrepancy; no new primary source cited
why Provides independent corroboration from a second domain; CVSS discrepancy is flagged but does not materially alter the assessment
- What is the historical exploitation context for Gitea, particularly regarding CVE-2026-20896?Fetched BleepingComputer reporting on the CVE-2026-20896 Gitea Docker auth bypassbleepingcomputer.com ↗
CVE-2026-20896 (CVSS 9.8 Docker auth bypass) was exploited via VPN-exit scanner probing 13 days after public disclosure; patched in 1.26.3/1.26.4; Sysdig reported the exploitation
why Establishes that Gitea is an actively targeted platform with a demonstrated short exploitation window post-disclosure, supporting the urgency of patching CVE-2026-59774 before opportunistic scanning begins
- Is there any public PoC, exploit code, or XBOW Security technical write-up for CVE-2026-59774?Searched for XBOW Security research write-ups and public exploits for CVE-2026-59774
No independently published PoC or exploit code identified; no XBOW Security technical write-up found in search results; file-read primitive publicly previewed before formal advisory per THN but no specific URL or content detail available
why Absence of confirmed PoC is a material fact distinguishing technical possibility from demonstrated exploit; the token-to-hook RCE chain therefore remains single-sourced to Gitea's advisory
Research coverage
All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (1 primary, 1 corroborating, 0 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| The Hacker Newsnews | ok14 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| BleepingComputernews | ok7 records | Corroborating1 matched items | Supplied independent analysis opened and verified during focused research. |
| AlienVault OTXdark_web | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CISA KEVkev | ok1661 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco PSIRTvendor_advisory | stale fallback0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok672 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1007 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| FIRST EPSSepss | ok7492 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok17 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok16 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| NVDcve | ok900 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sigma Rulesresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
Additional verified pages 6 opened outside the registered collection
Technical references1
Repository captured from the source article as technical context; not validated as PoC or exploit code.
Vendor & gov advisories2
Vendor-authoritative release post confirming CVE-2026-59774 and CVE-2026-60004 patch details and reporter credits
Formal primary advisory: CVSS 9.8, CWE-22, affected 1.22.1–1.27.0, patched 1.27.1, credits XBOW Security and NightRang3r
Analysis & research2
Independent corroborating technical analysis; confirms GHSA reference and RCE escalation path; minor CVSS discrepancy (cites 9.9 vs advisory's 9.8)
Documents active exploitation of prior Gitea flaw CVE-2026-20896, establishing demonstrated attacker interest in the platform