{"id":"CVE-2026-59774","aliases":["EUVD-2026-101281","GHSA-6v53-hr58-556r"],"status":"published","title":"Gitea Org-mode file disclosure and code execution","description":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.28308,"percentile":0.98144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2026-10-14T14:28:25Z","modified":"2026-10-28T02:30:51Z","exploits":[{"source":"metasploit","id":"auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774","title":"Forgejo Arbitrary File Read via Org-mode Include","type":"auxiliary","date":"2026-07-30","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774"},{"source":"nuclei","id":"CVE-2026-59774","title":"Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59774.yaml"},{"source":"pocgithub","id":"FlowerWitch/CVE-2026-59774_docker","title":"FlowerWitch/CVE-2026-59774_docker","date":"2026-08-06","url":"https://github.com/FlowerWitch/CVE-2026-59774_docker"},{"source":"pocgithub","id":"Ly0kha/CVE-2026-59774","title":"Ly0kha/CVE-2026-59774","date":"2026-10-24","url":"https://github.com/Ly0kha/CVE-2026-59774"},{"source":"pocgithub","id":"asvorg/CVE-2026-59774-poc","title":"asvorg/CVE-2026-59774-poc","date":"2026-10-21","url":"https://github.com/asvorg/CVE-2026-59774-poc"}],"products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/38642","tags":["patch","fix"]},{"url":"https://blog.gitea.com/release-of-1.27.1/","tags":["release-notes","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/38645","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.1","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/10/3","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59774.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59774","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59774","title":"Gitea Org-mode file disclosure and code execution","description":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.","status":"published","published":"2026-10-14T14:28:25.862Z","modified":"2026-10-15T03:56:54.937Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-101281","description":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.","status":"published","published":"2026-10-14T14:28:25Z","modified":"2026-10-15T03:56:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:00:15.585288Z"}],"nvd":[{"id":"CVE-2026-59774","description":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.","status":"published","published":"2026-10-14T15:17:20.677Z","modified":"2026-10-15T04:18:24.663Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"CVE-2026-59774","title":"Gitea Org-mode file disclosure and code execution","description":"Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.","status":"published","published":"2026-10-14T14:28:25.862Z","modified":"2026-10-28T02:30:51.030088262Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:12.496548Z"}]}}