CVE-2026-59774
An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 28.3%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 28.31% probability · 98th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Source
- 88ee5874-cf24-4952-aea0-31affedb7ff2
EPSS moved from 28.3% on 15 October 2026 to 28.3% on 26 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
References
- https://blog.gitea.com/release-of-1.27.1/
- https://github.com/go-gitea/gitea/pull/38642
- https://github.com/go-gitea/gitea/pull/38645
- https://github.com/go-gitea/gitea/releases/tag/v1.27.1
- https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r
- http://www.openwall.com/lists/oss-security/2026/08/10/3
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.