{"id":1322,"date":"2026-08-07T10:00:00","date_gmt":"2026-08-07T10:00:00","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/08\/07\/gitea-kritische-luecke-cve-2026-59774-erlaubt-auslesen-beliebiger-dateien\/"},"modified":"2026-08-17T23:09:48","modified_gmt":"2026-08-17T23:09:48","slug":"gitea-kritische-luecke-cve-2026-59774-erlaubt-auslesen-beliebiger-dateien","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/de\/2026\/08\/07\/gitea-kritische-luecke-cve-2026-59774-erlaubt-auslesen-beliebiger-dateien\/","title":{"rendered":"Kritische Gitea-L\u00fccke (CVSS 9.8): beliebige Dateien lesbar"},"content":{"rendered":"<div id=\"netgu-2641673966\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>In der selbstgehosteten Git-Plattform Gitea klafft eine kritische Sicherheitsl\u00fccke: \u00dcber CVE-2026-59774 \u2013 bewertet mit dem h\u00f6chstm\u00f6glichen CVSS-Score von 9.8 \u2013 k\u00f6nnen unauthentifizierte Angreifer beliebige Dateien vom Server auslesen. Betreiber sollten umgehend aktualisieren.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Angreifbar ist der Endpunkt zum Rendern von Markup auf <strong>\u00f6ffentlichen Repositories<\/strong>. Ein Angreifer kann dort Org-mode-Markup mit einer <code>#+INCLUDE<\/code>-Direktive einreichen, die auf einen absoluten Pfad zeigt. Gitea liest die angegebene Datei daraufhin aus \u2013 und zwar jede Datei, auf die das Dienstkonto von Gitea zugreifen kann. Als Ursache gilt, dass die genutzte Bibliothek <code>go-org<\/code> ohne einen abgesicherten <code>ReadFile<\/code>-Callback initialisiert wurde.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Betroffene Versionen und Update<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Betroffen:<\/strong> Gitea 1.22.1 bis 1.27.0.<\/li>\n\n\n\n<li><strong>Behoben in:<\/strong> Gitea 1.27.1 (ver\u00f6ffentlicht am 2. August 2026).<\/li>\n\n\n\n<li><strong>Risiko:<\/strong> unauthentifiziert ausnutzbar, keine Anmeldung n\u00f6tig.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Da die L\u00fccke ohne Zugangsdaten und allein \u00fcber \u00f6ffentliche Repositories ausgenutzt werden kann, ist besonders jede aus dem Internet erreichbare Instanz gef\u00e4hrdet. Ein \u00f6ffentlicher Write-up erh\u00f6ht den Handlungsdruck zus\u00e4tzlich. Wer Gitea betreibt, sollte zeitnah auf 1.27.1 aktualisieren \u2013 und generell den Zugang absichern, etwa hinter einem <a href=\"https:\/\/netguide.io\/news\/de\/nginx-reverse-proxy-konfigurieren\/\">Reverse Proxy<\/a> oder einem VPN.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Quelle: <a href=\"https:\/\/blog.elest.io\/self-hosted-weekly-week-32-2026-proxmox-arm64-rust-ai-policy-gitea-cve\/\" target=\"_blank\" rel=\"noopener\">Self-Hosted Weekly (elest.io), Week 32\/2026<\/a>.<\/em><\/p>\n<div id=\"netgu-451873240\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Kritische Gitea-L\u00fccke CVE-2026-59774 (CVSS 9.8): unauthentifizierte Angreifer k\u00f6nnen beliebige Dateien auslesen. Das Update auf 1.27.1 schlie\u00dft sie.<\/p>\n","protected":false},"author":1,"featured_media":1483,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-1322","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=1322"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1322\/revisions"}],"predecessor-version":[{"id":1326,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1322\/revisions\/1326"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1483"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=1322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=1322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=1322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}