Summary An unauthenticated remote attacker can submit Org-mode markup containing a #+INCLUDE directive to POST /{owner}/{repo}/markup for any suitable public repository to read arbitrary server files. By extracting INTERNAL_TOKEN from app.ini, they can inject a Git hook through the internal logger and achieve command execution as the Gitea OS user during an anonymous clone. Details Gitea registers `POST /{username}/{reponame}/markup` with optional sign-in, repository assignment, and a repository-unit reader check. An anonymous user passes that check for a public repository with a normal readable code unit. The handler passes the supplied `Mode`, `Text`, and `FilePath` into Gitea's generic markup renderer. Selecting `Mode: file` and a `.org` filename chooses the Org-mode renderer. Gitea 1.27.0 initializes `go-org` using `org.New()` and does not replace its default `ReadFile` callback. In `go-org` 1.9.1, that callback is `ioutil.ReadFile`; `#+INCLUDE` accepts absolute paths and passes them directly to that callback. Preconditions - At least one repository is publicly readable and exposes a unit accepted by the repository markup route. A normal public repository with its code unit enabled satisfies this condition. - Standard Gitea storage permissions allow the service user to update Gitea's managed global Git configuration. Impact - Read arbitrary files accessible to the Gitea service user without an account. - Submit the file-read payload directly through a public repository's web markup route without committing a file or obtaining repository write access. - Expose Gitea configuration, internal bearer tokens, OAuth/JWT material, and deployment metadata Affected - The vulnerable version seem v1.22.1 ~ v1.27.0 Credit Found by @xbow-security. Triaged by Guido Leo <guido.leo@xbow.com>. Independently reported by https://github.com/NightRang3r