The self-hosted Git platform Gitea has a critical security flaw: via CVE-2026-59774 – rated with the maximum possible CVSS score of 9.8 – unauthenticated attackers can read arbitrary files from the server. Operators should update immediately.
The vulnerable component is the markup rendering endpoint on public repositories. An attacker can submit Org-mode markup there containing an #+INCLUDE directive pointing to an absolute path. Gitea then reads the specified file – any file the Gitea service account can access. The root cause is that the go-org library was initialised without a secured ReadFile callback.
Affected versions and update
- Affected: Gitea 1.22.1 through 1.27.0.
- Fixed in: Gitea 1.27.1 (released on 2 August 2026).
- Risk: exploitable without authentication, no login required.
Because the flaw can be exploited without credentials and purely via public repositories, every internet-facing instance is particularly at risk. A public write-up adds further urgency. Anyone running Gitea should update to 1.27.1 promptly – and generally harden access, for example behind a reverse proxy or a VPN.
Source: Self-Hosted Weekly (elest.io), Week 32/2026.
