Gitea CVE-2026-73539

Exploitation requires that the Gitea instance has one or more external markup renderers explicitly configured (via the [markup.<renderer>] sections in app.ini), which is NOT enabled by default - this is the primary limiting factor and sharply narrows the exposed population. An attacker also needs a low-privilege authenticated account (PR:L) able to submit markup content or influence a repository ref/branch name that flows into the external renderer command, and must craft input that survives the pre-fix string substitution to inject extra arguments (reflected in AC:H). Instances using only Gitea's built-in Markdown/markup rendering, with no configured external renderers, are not affected.

Signals point to a moderate, conditional risk rather than a widespread emergency. The CVSS 3.1 base score of 7.5 reflects full C:H/I:H/A:H impact, but the vector itself tempers this with AC:H (high attack complexity) and PR:L (authenticated low-privilege attacker), meaning exploitation is neither trivial nor fully anonymous. EPSS is low at 0.26% (16th percentile), consistent with the absence of a public exploit and no CISA KEV listing - exploitation status is 'no public exploit identified at time of analysis.' The source diff confirms this is an argument-injection flaw (CWE-88) in Gitea's external markup renderer, where command variables were substituted into the full command string before shell tokenization; this only matters on instances that have external renderers configured, which is NOT the default. Note a signal conflict: the input Tags label this 'Information Disclosure,' but CWE-88 and the code evidence describe command argument injection with full CIA impact, so the 'Information Disclosure' framing understates the issue - treat the CWE-88/code evidence as authoritative over the tag. Also note a minor version discrepancy: Gitea's own release notes fix this in 1.27.2, while the Alpine advisory cites 1.27.3-r0 (package revisioning), so verify the exact fixed package for your distro.

On a Gitea instance configured with external markup renderers (a non-default [markup.*] setting), an authenticated low-privilege user supplies crafted repository content or a ref/branch value that is interpolated into the external renderer's command line, injecting additional arguments (CWE-88) that alter how the external program executes. The high attack complexity (AC:H) reflects the need for a specific renderer configuration and a carefully crafted payload. No public exploit code was identified at the time of analysis.