Description
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Gitea Gitea
Default version status: unaffected
1.22 to < 1.27.1affected
References
- https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r ↗
- https://github.com/go-gitea/gitea/pull/38642 ↗
- https://blog.gitea.com/release-of-1.27.1/ ↗
- https://github.com/go-gitea/gitea/pull/38645 ↗
- https://github.com/go-gitea/gitea/releases/tag/v1.27.1 ↗
- http://www.openwall.com/lists/oss-security/2026/08/10/3 ↗