Critical Vulnerability Discovered in Gitea
Versions 1.22.1 through 1.27.0 of Gitea, the self-hosted Git service, have been found vulnerable to a critical flaw that allows unauthenticated attackers to access files. This issue requires neither login credentials nor repository write access; a public repository and specially crafted Org-mode markup are sufficient for exploitation. The vulnerability has been addressed in version 1.27.1.
Details of the Vulnerability
Identified as CVE-2026-59774, this vulnerability received a CVSS score of 9.8, marking it as critical. The advisory, released on August 2, noted the flaw’s potential for severe exploitation. Alongside this, Gitea 1.27.1 also resolved CVE-2026-60004, a separate remote code execution vulnerability.
Cloud-based Gitea instances will undergo automatic updates during maintenance windows, while self-hosted versions require immediate manual updates. The vulnerability is not a direct path to remote code execution but could lead to it if specific conditions are met, as outlined in Gitea’s advisory.
How the Flaw Operates
The flaw involves Gitea’s markup rendering endpoint, particularly affecting Org-mode processing. The endpoint, accessed via POST requests, allows optional sign-in and verifies repository access. Public repositories with code units enabled are susceptible to this attack path.
The breach originates from Gitea’s Org-mode renderer, which improperly utilized the go-org library’s default ReadFile callback, allowing unauthorized file reads. Attackers can exploit this by submitting Org-mode markup with the Mode: file directive to access files the service account can read. The issue has been resolved in a recent patch that ensures Org-mode paths are rendered as plain text.
Security Measures and Recommendations
Administrators are advised to scrutinize anonymous POST requests to the markup endpoint, especially those related to Org-mode or absolute file paths. If there’s a suspicion of attempted exploitation, it’s crucial to review repository hook directories for any unexpected files.
While no public exploits have been reported, and the vulnerability has not been listed in CISA’s Known Exploited Vulnerabilities catalog, precautionary measures should be taken. The advisory suggests rotating sensitive credentials if the vulnerability is suspected to have been exploited.
Recent Security Work at Gitea
This vulnerability is part of a series of security issues Gitea has addressed recently. In June, a significant reverse-proxy authentication bypass was patched, which had been actively probed soon after its disclosure. In May, a container-registry access-control flaw impacted thousands of deployments worldwide.
In conclusion, while Gitea has moved swiftly to address these vulnerabilities, administrators should remain vigilant, ensure systems are updated, and review security protocols to mitigate potential risks.
