vulnerability
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
Critical
Summary
A critical vulnerability (CVE-2026-59774) in Gitea versions 1.22.1 through 1.27.0 allows unauthenticated attackers to read files accessible to the service account. While a direct remote code execution exploit hasn't been publicly demonstrated, a complex chain involving Org-mode markup and internal hooks can lead to command execution. Gitea 1.27.1 has been released to address this issue.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data