CVE-2026-59774: Gitea Org-mode file disclosure and code execution
Vendor fix available · Affected: Gitea · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public3 public GitHub repositories (unverified), listed by PoC-in-GitHub6 Aug
- Not established: not seen
Higher than 98% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- Gitea
- Published
- October 2026
What changed
- PoC-in-GitHub lists 3 public GitHub repositories (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 4 Aug.
- Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code ExecutionSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.