🚨 CVE-2026-59774: Unauthenticated LFI in Gitea via Org-Mode
Heads up, everyone. If you're managing a self-hosted Gitea instance, you need to patch this immediately. A new critical flaw (CVE-2026-59774) has dropped with a CVSS score of 9.8.
The gist of it? An unauthenticated attacker can read any file accessible by the Gitea service account. They don't need a login, write access, or even a private repo. All they need is a public repository and a specifically crafted Org-mode markup file.
Affected versions are 1.22.1 through 1.27.0. The fix is available in version 1.27.1.
The Mechanism
The vulnerability lies in how the renderer handles Org-mode markup. It allows for file inclusion functionality that wasn't properly sanitized. If an attacker pushes a file (e.g., README.org) with malicious directives, the server processes it and spits back local file contents.
Detection
Since this is unauthenticated, you'll want to grep your access logs for suspicious Org-mode syntax, specifically include directives.
# Search for Org-mode include patterns in Nginx/Apache or Gitea logs
zgrep -i "#+include:" /var/log/nginx/gitea-access.log*
If you are hosting sensitive configs or secrets in environment variables that the service account can see, consider them compromised until patched.
Discussion
How is everyone handling the rollout of 1.27.1? I'm worried about legacy instances where upgrading might break custom templates. Also, has anyone seen active exploitation in the wild yet, or are we still in the "script kiddie scanning" phase?
Thanks for the heads-up. We just pushed the update to our internal registry. It's a classic case of "feature becoming a vulnerability"—Org-mode is powerful but parsing it securely is a nightmare.
If you can't update immediately, consider disabling the rendering of Org-mode files if your config allows it, or strictly restricting public repo creation to trusted users only.
Good call on the logs. From a pentester's perspective, this is low-hanging fruit. We're already checking for this on assessments. If you're worried about data exfil, check if the service account has access to things like /etc/shadow or database backups.
# Quick check on your running Gitea container/user permissions
docker exec -it -u git gitea cat /etc/passwd
If that works, an attacker can see it too.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access