Gitea: Critical File Read via Org-mode, RCE Risk with CVSS 9.8

CVE-2026-59774 affects Gitea 1.22.1 through 1.27.0: an unauthenticated attack exploits Org-mode markup to read arbitrary files and potentially achieve remote code execution.

A critical vulnerability in Gitea's rendering engine allows an unauthenticated attacker to read arbitrary files on the server via an Org-mode markup directive. The flaw, published August 2, 2026 in advisory GHSA-6v53-hr58-556r, earned the maximum score for this bug class: CVSS 9.8. The escalation chain to remote execution, described in the project's official advisory, remains theoretically valid but has not been independently demonstrated as of publication.

Key Takeaways

CVE-2026-59774 affects Gitea from version 1.22.1 to 1.27.0 with an unauthenticated attack via the POST /{owner}/{repo}/markup endpoint
The vector exploits the Org-mode #+INCLUDE directive, which passes absolute filesystem paths through the unreplaced ReadFile callback of go-org 1.9.1
The fix in version 1.27.1 replaces the callback to return the path as content instead of resolving it from the filesystem
The RCE chain documented in the advisory proceeds from reading app.ini to stealing INTERNAL_TOKEN and injecting a Git hook, but has received no independent verification or public exploit

The Mechanism: When Markup Rendering Becomes a Filesystem Syscall

Gitea uses the go-org 1.9.1 library to render Org-mode files, a lightweight markup language originating in the Emacs ecosystem. The default initialization of go-org exposes a ReadFile callback pointing to ioutil.ReadFile, a direct filesystem read function. Gitea does not replace this callback with a sandboxed handler.

The Org-mode #+INCLUDE directive is designed to embed external content. In the vulnerable implementation, it accepts absolute server filesystem paths and passes them directly to the ReadFile callback without validation. An attacker can therefore send a POST request to the /{owner}/{repo}/markup endpoint with parameters Mode: file and filename: .org containing a #+INCLUDE directive pointing to any file readable by the Gitea service account.

The attack requires only the existence of at least one public repository with the code unit enabled. No authentication or repository write permissions are necessary.

"An unauthenticated remote attacker can submit Org-mode markup containing a #+INCLUDE directive to POST /{owner}/{repo}/markup for any suitable public repository to read arbitrary server files" — GitHub Advisory GHSA-6v53-hr58-556r

From File Read to RCE: The Advisory's Theoretical Chain

The official Gitea advisory describes an escalation chain that turns arbitrary file reading into remote execution. The path begins with exfiltration of the app.ini file, which contains the INTERNAL_TOKEN parameter used for internal service communications. With this token, an attacker could inject a Git hook through the internal logging mechanism, achieving command execution as the operating system user running Gitea during an anonymous clone.

This chain is documented exclusively in the project's advisory. According to The Hacker News, "the token-to-hook command-execution chain remains single-sourced to Gitea's advisory": no independent researcher has published a proof-of-concept demonstrating it, and no confirmed in-the-wild exploitation exists as of August 5, 2026. The flaw is not present in CISA's KEV catalog.

The distinction between the verified file-read primitive and the theoretical RCE chain matters for risk assessment. Arbitrary file reading is immediately exploitable and can expose configurations, database credentials, API keys, and other secrets without administrator interaction. Escalation to RCE requires additional conditions that have not been publicly quantified.

Who Discovered the Flaw: The Emerging Role of Autonomous Tools

The primary discovery is attributed to XBOW Security, an autonomous offensive security system that conducts vulnerability research without direct human intervention. Technical triage was conducted by Guido Leo. An independent report, received before or in parallel, comes from Shai Rod, known as NightRang3r.

This discovery profile signals an evolution in the vulnerability research landscape: autonomous offensive security tools are producing results comparable to traditional human teams, at least for bug classes where the attack surface is defined by documented APIs and parsing formats. For Gitea, an open-source project with a public codebase and standardized endpoints, the combination of automated analysis and human review uncovered a flaw that previous audits had missed.

A preview of the file-read primitive was published before the formal advisory, according to The Hacker News. The brief does not specify whether this early disclosure generated active exploitation attempts before the patch became available.

What to Do Now

Immediately update self-hosted instances to Gitea 1.27.1, which contains the fix in pull requests #38642 and #38645
Verify that Cloud instances have been automatically updated during the release maintenance window, as stated by Gitea to The Hacker News
Proactively rotate INTERNAL_TOKEN and other secrets present in app.ini even after patching, given the possibility of pre-patch exfiltration
Limit exposure of public repositories with code unit enabled where not strictly necessary, reducing the attack surface

Why the Org-mode Vector Challenges Traditional Defenses

The choice of Org-mode as an attack vector has consequences for detection. Lightweight markup formats do not typically fall within the analysis perimeter of security systems, which prioritize executables, scripts, and known payloads. A POST request to a rendering endpoint with legitimate Org-mode content is indistinguishable from normal traffic without semantic inspection of the payload.

The case also raises a recurring architectural question: the integration of "harmless" parsing libraries into applications with elevated privileges. go-org is a text rendering library; its ReadFile callback is not documented as dangerous unless misconfigured. The absence of default sandboxing, combined with Gitea's failure to replace the callback, created an attack primitive where no one would expect to find one.

Self-hosted instances remain the most exposed surface. Gitea has stated that Cloud instances are updated automatically, but the brief does not quantify the completeness of secret rotation in that context. For on-premise administrators, the combination of immediate patching and preventive token rotation represents the most conservative response.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references