A critical vulnerability in Gitea — the popular self-hosted Git platform — lets an unauthenticated attacker read any file that the Gitea service account can access on the server. No login required and no repository write access needed: a public repository and a single crafted HTTP request containing Org-mode markup is enough to trigger the flaw. The bug, tracked as CVE-2026-59774 with a CVSS score of 9.8, affects Gitea versions 1.22.1 through 1.27.0. The fix is Gitea 1.27.1, released August 2, 2026. Cloud instances of Gitea are being upgraded automatically; all self-hosted administrators should update immediately.
The vulnerability lives in Gitea’s Org-mode document renderer, which uses the go-org library. When Gitea 1.27.0 initialized the renderer it left the library’s default ReadFile callback in place — ioutil.ReadFile, which reads from the local filesystem. Org-mode’s #+INCLUDE directive can reference absolute file paths, so an attacker can craft a document that includes /etc/passwd, private SSH keys, or Gitea’s own app.ini configuration file. On its own, this is a server file read. But Gitea’s advisory notes that a determined attacker who reads app.ini and extracts the INTERNAL_TOKEN can chain this into remote code execution by injecting a Git hook through the internal logger and triggering it during an anonymous repository clone. Gitea says no public exploit demonstrating the full chain has been published, but the upgrade is considered urgent regardless.
How to check if you’re affected
Affected versions are Gitea 1.22.1 through 1.27.0. Run gitea --version on your server to confirm. If your instance has any public repositories with the code unit enabled (the default), it is exposed to unauthenticated file reads via this endpoint. If you suspect your instance may have been reached before patching — for example, if you see unusual POST requests to /{owner}/{repo}/markup in your access logs — treat all credentials accessible by the Gitea service account as compromised: rotate the internal token, any OAuth client secrets, JWT signing material, and database credentials before returning the instance to service.