Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code Execution
Do Son 
TL;DR
Gitea 1.27.1 patches a critical Gitea vulnerability, CVE-2026-59774, rated CVSS 9.8. An unauthenticated attacker can read arbitrary server files through a public repository, then escalate to remote code execution. Anyone self-hosting Gitea should upgrade to 1.27.1 now.
Why it matters
Gitea powers self-hosted Git servers for thousands of teams. This Gitea vulnerability needs no account and no user interaction. Therefore, any exposed instance with a public repository is at risk. The advisory warns an attacker can “read arbitrary files accessible to the Gitea service user without an account.” That list includes secrets like config files and bearer tokens.
How the attack works
The flaw sits in Gitea’s markup preview route. An anonymous user can post Org-mode markup to a public repository’s markup endpoint. The renderer honors the Org-mode #+INCLUDE directive, which accepts absolute file paths. Because the underlying reader was left unrestricted, it returns any file the service can access. From there, an attacker pulls the INTERNAL_TOKEN from app.ini. Next, they plant a Git hook through the internal logger. That hook then runs during an anonymous clone, which delivers remote code execution as the Gitea OS user.
Affected versions
The bug affects Gitea releases from 1.22.1 through 1.27.0. The maintainers classify it as a path traversal weakness (CWE-22). Both Windows and Linux hosts are in scope.
Patch and mitigation
Upgrade to Gitea 1.27.1 without delay. The same release also shipped other security fixes. So far, no in-the-wild attacks have been confirmed. However, researchers publicly demonstrated the file read reaching /etc/passwd before the patch. For full technical detail, review Gitea’s security advisory. Until you patch, limit network exposure and audit which repositories stay public.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
