CVE-2026-59774

9.8 CRITICALpublic exploit available

Published 2026-10-14 · Updated 2026-10-15

AI risk analysis

Summary: Gitea's Org-mode renderer allows unauthenticated attackers to read arbitrary server files via INCLUDE directives, potentially leading to full system compromise through command execution.
Exploitability: Very easy to exploit with no prerequisites; attackers only need access to a public repository to trigger file disclosure.
Blast radius: High impact across all Gitea installations using Org-mode markup, especially those with sensitive configuration files accessible to the service account.
Detection: Monitor for unusual file access patterns in the Gitea service account's directory and check for requests to the repository markup endpoint with INCLUDE directives in the logs.
Prioritized remediation: Upgrade to Gitea 2.590 or later to fix the Org-mode INCLUDE directive processing vulnerability.

file-disclosurerceorgmodegitea

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.