CVE-2026-59774 Gitea Org-mode file disclosure and code execution
Unauthenticated attackers can read server files via Org-mode INCLUDE directives and potentially execute code by chaining with token disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59774?
CVE-2026-59774 is a critical path traversal vulnerability in Gitea, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
Weakness: CWE-22
Which versions are affected by CVE-2026-59774?
How do I fix CVE-2026-59774?
No fix has been published for CVE-2026-59774 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-59774 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59774 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 3 proofs of concept on GitHub.
Sources
Also known as GHSA-6v53-hr58-556r.