Critical Gitea Vulnerability (CVE-2026-59774) Exposes Servers to Remote Code Execution A severe vulnerability in Gitea, tracked as CVE-2026-59774, allows unauthenticated attackers to read arbitrary files on vulnerable servers and potentially achieve remote code execution (RCE). The flaw, disclosed under GHSA-6v53-hr58-556r, affects Gitea versions 1.22.1 through 1.27.0 and has been patched in version 1.27.1. With a CVSS v3.1 score of 9.8 (Critical), the vulnerability requires no authentication, user interaction, or elevated privileges, making internet-exposed Gitea instances particularly high-risk. The issue stems from Gitea’s repository markup rendering endpoint (`POST /{owner}/{repo}/markup`), where anonymous users can exploit public repositories with readable code units enabled. Attackers can submit Org-mode markup data with an `.org` filename, triggering Gitea’s go-org library which, in affected versions, uses `ioutil.ReadFile` without proper path restrictions. The `#+INCLUDE` directive in Org-mode allows absolute filesystem paths, enabling attackers to read files accessible to the Gitea service account, including: - `app.ini` configuration files - Internal bearer tokens - OAuth/JWT signing keys - Server-side secrets Exfiltrating Gitea’s `INTERNAL_TOKEN` could escalate the attack further, allowing interaction with internal Gitea functions and injection of malicious Git hooks. When an anonymous Git clone is performed, these hooks could execute commands as the Gitea OS user, leading to full server compromise. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). Organizations are vulnerable if they run an affected Gitea version and host at least one publicly readable repository with a code unit accepted by the markup route. Standard Gitea storage permissions may also allow the service account to modify global Git configurations, increasing RCE risks. Mitigation involves upgrading to Gitea 1.27.1 or later and rotating exposed secrets, including internal tokens, OAuth credentials, and JWT keys. Security teams should also review logs for unusual anonymous requests to markup endpoints, particularly those involving Org-mode rendering.