Gitea CVE-2026-59774

Exploitation requires that Gitea render an attacker-controlled Org-mode (.org) file - i.e. the attacker must be able to place such a file in a repository, issue, wiki, or comment that the server will render via the orgmode markup module. The vulnerable behavior is the org parser's processing of #+INCLUDE: directives, which read files from the server filesystem. Limiting factors: the target Gitea instance must be running an affected version (1.22 through <1.27.1), org-mode content must actually be rendered (the attacker typically needs the ability to create/push a repository or post rendered content, implying at least a registered account unless open registration is enabled), and impact is primarily arbitrary file disclosure rather than code execution.

The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which rates this as critical network-exploitable with full CIA impact and no privileges. However, the GitHub PR diff (go-gitea/gitea#38642) shows the actual flaw is in org-mode markup rendering: the parser honored #+INCLUDE: directives, allowing arbitrary server-side file inclusion/disclosure. This is fundamentally a CWE-22 path-traversal file-read primitive, so the real-world impact is weighted heavily toward confidentiality - the I:H/A:H components of the 9.8 vector appear overstated for an INCLUDE-based file read and should be verified against the GHSA-6v53-hr58-556r advisory. PR:N (unauthenticated) is also questionable: realistically an attacker must get Gitea to render a malicious .org file, which typically requires an account to create/push a repository; on instances with open registration this approaches unauthenticated, but on locked-down instances it is effectively PR:L. A public exploit is reported (POC=YES) which raises urgency, but there is NO EPSS score and NO CISA KEV entry provided, so there is no evidence of active or widespread exploitation at this time. Net: a genuine high-priority issue for internet-exposed Gitea instances given low complexity and POC availability, but the raw 9.8/CIA-full rating likely overstates integrity/availability impact relative to the confirmed file-disclosure behavior.

An attacker creates or pushes a repository to a Gitea instance containing a crafted Org-mode (.org) file that uses #+INCLUDE: directives with traversal paths; when Gitea renders that file, the org parser reads and discloses arbitrary files from the server's filesystem (e.g. configuration or secrets). A public exploit is reported to exist, and with AV:N/AC:L the attack is low-complexity over the network, limited mainly by the need to host the malicious file where it will be rendered.