CVE-2026-59774: Gitea File Read Escalates to RCE — Patch Now

Gitea 1.27.1 landed July 27 with patches for two critical vulnerabilities that put every self-hosted instance on 1.27.0 and below at serious risk. The lead flaw, CVE-2026-59774 (CVSS 9.8), lets an unauthenticated attacker read arbitrary server files — including app.ini, INTERNAL_TOKEN, and database credentials — using nothing but Org-mode markup and a public repository. The second, CVE-2026-60004, brings a public proof-of-concept for RCE via the diffpatch API. Both are fixed in Gitea 1.27.1. Patch now.

The Flaw: An Org-Mode Renderer That Forgot to Stay in Its Lane

CVE-2026-59774 exists because Gitea 1.27.0 upgraded its Org-mode rendering library, go-org, but did not replace the library’s default file-read callback. In go-org 1.9.1, that callback is ioutil.ReadFile — a function that reads files directly from the server filesystem with no path restrictions.

Org-mode’s #+INCLUDE directive embeds external file contents into a document. With the unmodified callback in place, an attacker submits crafted Org-mode markup to Gitea’s rendering endpoint and receives any file the service account can read:

POST /myorg/myrepo/markup
Mode: Org-mode
Content: #+INCLUDE: "/etc/gitea/app.ini"

Gitea renders the markup and returns file contents in the HTML response. No authentication. No repository write access. Any public repository works. The full advisory (GHSA-6v53-hr58-556r) notes it affects Gitea versions 1.22.1 through 1.27.0. The fix in 1.27.1 (PR #38642) overrides the ReadFile callback so #+INCLUDE paths render as plain text instead of resolving against the filesystem.

File Read to Full Compromise: The Escalation Chain

A file read earning CVSS 9.8 is not accidental. Gitea’s app.ini contains an INTERNAL_TOKEN that authenticates calls to Gitea’s internal API. Read that token, and an attacker can call the internal logger endpoint with a crafted payload to inject an executable Git hook into any repository. The hook runs on the next anonymous clone — as the Gitea service account.

The escalation is: read app.ini, extract INTERNAL_TOKEN, inject a hook via the internal API, trigger it on clone, achieve code execution. Every step flows from the file read. That is why this is rated critical despite starting as “just” a read vulnerability. The Hacker News writeup has a thorough breakdown of the chain.

The Second Critical: CVE-2026-60004

CVE-2026-60004 (CVSS 9.8) is a separate RCE in the diffpatch API present since Gitea 1.17.0. Submitting the same patch twice to POST /api/v1/repos/{owner}/{repo}/diffpatch triggers an add/add collision. Git’s three-way merge fallback writes a file at hooks/post-index-change — a hook introduced in Git 2.32 that fires on every index update. Plant an arbitrary executable there and every subsequent Git index operation becomes server-side code execution.

This requires an authenticated user with repository write access — but Gitea enables open registration by default. An attacker creates a fresh account, creates a repository, and exploits the bug without any pre-existing credentials. A public PoC is in the wild. See the advisory GHSA-rcr6-4jqh-j84m for the full technical breakdown.

What You Need to Do

Both CVEs are fixed in Gitea 1.27.1. Upgrade first, rotate secrets second if you suspect exposure.

Binary upgrade:

sudo systemctl stop gitea
wget https://dl.gitea.com/gitea/1.27.1/gitea-1.27.1-linux-amd64
chmod +x gitea-1.27.1-linux-amd64
sudo mv gitea-1.27.1-linux-amd64 /usr/local/bin/gitea
sudo systemctl start gitea

Docker Compose upgrade:

# Update docker-compose.yml: image: gitea/gitea:1.27.1
docker-compose pull
docker-compose up -d

If your instance ran a vulnerable version with any public repositories, treat it as a potential compromise. After upgrading, rotate secrets:

gitea generate secret INTERNAL_TOKEN
gitea generate secret SECRET_KEY

Update app.ini with the new values and restart. Also rotate deploy keys, OAuth application secrets, and any credentials stored in the config. For post-incident audit steps, check the official Gitea upgrade guide and review POST logs to /{owner}/{repo}/markup for Org-mode mode selections, unexpected executable files in hook directories, and new user registrations during the exposure window.

Context: Gitea CVEs Are Getting Exploited Faster

This is the third critical Gitea vulnerability ByteIota has covered in 2026. CVE-2026-20896, the one-header admin bypass, was actively probed by threat actors within 13 days of disclosure. CVE-2026-27771, the private container image leak, followed the same pattern. The trend is clear: Gitea vulnerabilities attract exploitation quickly, and instances that lag on patching become targets within weeks, not months.

The root cause here — shipping a new library dependency without auditing its security callbacks — is the kind of thing that code review should catch. It didn’t. That happens. But it does mean that every Gitea upgrade from here forward warrants ten minutes to verify that new dependencies haven’t introduced similar footguns. The Org-mode renderer was a feature addition, not a security-sensitive path. That assumption was wrong.

Forgejo users should check codeberg.org/forgejo/forgejo for independent advisories — Forgejo maintains its own patch process separately from Gitea.