CVE-2026-59774: critical vulnerability in Gitea
Gitea Org-mode file disclosure and code execution
Published · Updated
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 28%
from disclosure to weapon0 days
Published on NVDOct 14
1st PoCAug 6
metasploitJul 30
VulnCheck+1d
exploitation probability
28%top 2% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Gitea · Giteapublic PoCs found — 1
githubgithub.com/FlowerWitch/CVE-2026-59774_docker★ 5⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Gitea
In the same product, most dangerous first.
CVE-2026-60004CRITICALCVE-2026-60004EPSS 24.0%KEVCVE-2019-1010314—CVE-2019-1010314EPSS 0.8%CVE-2019-1010261—CVE-2019-1010261EPSS 0.8%CVE-2026-63021MEDIUMGitea Swift package manifest memory exhaustionEPSS 0.5%CVE-2026-62925MEDIUMGitea Alpine package parsing memory exhaustionEPSS 0.5%CVE-2026-60018MEDIUMGitea OneDev migration denial of serviceEPSS 0.5%
References
https://blog.gitea.com/release-of-1.27.1/https://github.com/go-gitea/gitea/pull/38642https://github.com/go-gitea/gitea/pull/38645https://github.com/go-gitea/gitea/releases/tag/v1.27.1https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556rhttp://www.openwall.com/lists/oss-security/2026/08/10/3