CVE-2026-59774

Gitea Org-mode file disclosure and code execution

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

Affected

Gitea

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

28.31% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-22

Published

2026-10-14

Updated

2026-10-15

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59774.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/forgejo_orgmode_fileread…

References

• CVE Record
• NVD entry