CVE-2026-59774GHSA-6v53-hr58-556r

Gitea Org-mode file disclosure and code execution

Gitea Gitea

CVSS

9.8Critical

ExploitationPublic exploit codeAuxiliary module, 30 Jul 2026. Not in the KEV catalogMetasploit

Exploit odds (EPSS)28.3%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in1.27.1Fixed versionCVE List

Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

1.27.1GiteaCVE List
1.27.1gitea.dev, goGitHubgo get gitea.dev@v1.27.1

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

30 Jul 2026Exploit code publicMetasploit
14 Oct 2026, 14:28 UTCPublishedCVE List

Public exploit code and templates 2

Auxiliary moduleForgejo Arbitrary File Read via Org-mode Include 30 Jul 2026Metasploit
Scanner templateGitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File ReadNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

asvorg/CVE-2026-59774-poc: PoC for Gitea versions before 1.27.1 is vulnerable to Path Traversal (CWE-22), which leads to unauthenticated arbitrary file read / information disclosure leading to RCE CVSS 9.8GitHub proof-of-concept repositories, 21 Oct 2026Exploit code

Description

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

Text from CVE List

Affected versions 2

Giteaaffected: 1.22 before 1.27.1CVE List
gitea.dev, go1.22 < 1.27.1GitHub