CVE-2026-59774

Executive Summary

CVE-2026-59774 is a critical path traversal vulnerability (CWE-22) in Gitea's Org-mode markup renderer, which fails to prevent access to server-side files when processing INCLUDE directives submitted to the repository markup endpoint. An unauthenticated attacker can leverage any public repository to read files accessible to the Gitea service account, achieving a CVSS score of 9.8. If the exposed files include app.ini and its INTERNAL_TOKEN, the attacker can chain this disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account, resulting in full compromise of the underlying host.

Technical Analysis

The vulnerability resides in the Org-mode markup renderer used by Gitea to display repository content. Org-mode supports an INCLUDE directive that allows one document to embed the contents of another file. When Gitea processes markup submitted to its repository markup endpoint, it does not adequately restrict the file paths that can be supplied to these INCLUDE directives. This allows an attacker to reference arbitrary files on the server's filesystem, subject only to the permissions of the Gitea service account.

The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). The attack surface is the unauthenticated repository markup endpoint. Because the endpoint is accessible without authentication, an attacker only needs a suitable public repository (or the ability to create content that reaches the markup renderer) to trigger the read. The renderer processes the INCLUDE directive without validating that the resolved path remains within an allowed directory, enabling traversal to sensitive server-side files.

The primary target for the attacker is Gitea's configuration file, app.ini. This file contains the INTERNAL_TOKEN, a secret used for privileged internal API communication. Disclosing this token is the critical pivot point: it allows the attacker to authenticate to internal endpoints that are normally inaccessible to unauthenticated users. The NVD description explicitly states that the attacker can "chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account." This implies that the INTERNAL_TOKEN grants access to an internal logger endpoint, which in turn can be abused to write a Git hook (a script executed on Git operations such as push). By modifying a Git hook, the attacker achieves arbitrary command execution under the context of the Gitea service account. No public proof-of-concept code is available, but the exploit status is marked as Public, and the attack chain is fully consistent with the described mechanism.

Exploitation Scenarios

No public PoC is available; the following chain is inferred strictly from the NVD description and the vulnerability class.

1. Reconnaissance/Target Identification: The attacker identifies an internet-exposed Gitea instance. Shodan dorks using http.title:"Gitea" or the specific favicon hash can locate such instances. The attacker verifies that the repository markup endpoint is reachable without authentication. A public repository is required to host or supply the malicious Org-mode content.

2. Triggering the Path Traversal: The attacker crafts Org-mode markup containing an INCLUDE directive that references a path outside the intended repository directory. Because the renderer does not restrict the path, the directive resolves to a server-side file. The attacker submits this markup to the repository markup endpoint. The vulnerability class is a directory traversal (CWE-22); no specific function names or parameters beyond the INCLUDE directive are provided in the description. The attacker targets app.ini to extract the INTERNAL_TOKEN.

3. Payload/Execution Method at the Vulnerability-Class Level: With the INTERNAL_TOKEN in hand, the attacker authenticates to internal endpoints. The description specifically mentions chaining the disclosure with "internal logger access." The attacker uses the token to interact with the internal logger, which can be abused to modify a Git hook. A Git hook is a script that runs on the server when certain Git events occur. By overwriting or creating a hook (for example, a pre-receive or post-receive hook), the attacker can embed arbitrary shell commands that execute with the privileges of the Gitea service account.

4. Post-Exploitation Impact: Once a Git hook is modified, the attacker triggers the hook by performing a Git operation (e.g., pushing to a repository). The hook executes the attacker's commands, resulting in remote code execution as the Gitea service account. From there, the attacker can access the Gitea database, steal credentials, move laterally, or persist on the host. The impact is complete compromise of the Gitea service and potentially the underlying server.

Impact Assessment

The CVSS 3.1 base score is 9.8 (Critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack is network-accessible (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), and has low complexity (AC:L). The confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H). The scope is Unchanged (S:U), meaning the exploit impacts only the vulnerable Gitea component, though in practice the chained RCE affects the host.

Business impact is severe: an unauthenticated attacker can read arbitrary files and then escalate to remote code execution as the Gitea service account. This exposes secrets, source code, and potentially the entire software supply chain. Gitea is widely used for internal source control and CI/CD, so a compromise can allow attackers to poison build artifacts, inject backdoors into code, or pivot into adjacent infrastructure. The blast radius includes all repositories, user credentials, and any systems trusting the Gitea instance for authentication or automation. No patch is available, and no official workaround has been published, leaving exposed instances at immediate risk.

Detection Guidance

Sigma Rule

title: Gitea Org-mode INCLUDE Path Traversal Attempt
id: 8f2c9e1a-3b4d-4e5f-9a6b-7c8d9e0f1a2b
status: experimental
description: Detects attempts to exploit CVE-2026-59774 by abusing Org-mode INCLUDE directives to read server-side files such as app.ini.
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: gitea
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-query|contains: '/markup'
  selection_payload:
    cs-request-body|contains:
      - '#+INCLUDE:'
      - '#+include:'
  selection_paths:
    cs-request-body|contains:
      - 'app.ini'
      - '/etc/passwd'
      - '..%2f'
      - '../'
  condition: selection_endpoint and selection_payload and selection_paths
falsepositives:
  - Legitimate Org-mode documents using INCLUDE with relative paths inside the repository.
level: high

YARA Rule

rule CVE_2026_59774_Gitea_Org_INCLUDE_Traversal
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects Org-mode INCLUDE directives attempting path traversal against Gitea markup renderer (CVE-2026-59774)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59774"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $include1 = "#+INCLUDE:" nocase
        $include2 = "#+include:" nocase
        $traversal1 = "../"
        $traversal2 = "..%2f" nocase
        $target1 = "app.ini" nocase
        $target2 = "/etc/passwd"
    condition:
        any of ($include*) and any of ($traversal*) and any of ($target*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-59774 Gitea Org-mode INCLUDE Path Traversal Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/markup"; http.request_body; content:"#+INCLUDE:"; nocase; http.request_body; content:"app.ini"; nocase; classtype:attempted-recon; reference:cve,2026-59774; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-59774; sid:202659774; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and url.path contains "/markup" and
   http.request.body contains "#+INCLUDE:"]
  [http where http.request.body contains "app.ini" or http.request.body contains "../"]

Splunk SPL Query

index=web sourcetype=gitea_access
| search method=POST uri_path="*markup*" 
| where match(request_body, "(?i)#\\+INCLUDE:") AND (match(request_body, "app\\.ini") OR match(request_body, "\\.\\./") OR match(request_body, "etc/passwd"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, request_body
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="gitea,web,">
  <rule id="100774" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>POST</match>
    <match>/markup</match>
    <regex>#\+INCLUDE:</regex>
    <regex>app\.ini|\.\./|/etc/passwd</regex>
    <description>CVE-2026-59774: Gitea Org-mode INCLUDE path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_59774,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict access to the repository markup endpoint to authenticated users only, if feasible, or block unauthenticated access at the reverse proxy level.
   • Disable or restrict the Org-mode renderer if it is not required. Consult Gitea documentation for renderer configuration options, but note that no official workaround has been published.
   • Harden file permissions so the Gitea service account cannot read sensitive files such as app.ini. Ensure app.ini is readable only by the minimum necessary accounts and rotate the INTERNAL_TOKEN regularly if exposure is suspected.
   • Deploy WAF rules or network detection rules to block requests containing INCLUDE directives with traversal patterns targeting sensitive files.

2. Patch/Upgrade Steps:

   • No vendor patch is available as of this report. Monitor the official Gitea repository and security advisories for a fix.
   • Once a patch is released, apply it immediately. Until then, consider temporarily limiting Gitea's exposure to trusted networks only.

3. Long-term Hardening:

   • Run Gitea with a dedicated, unprivileged service account and enforce the principle of least privilege on filesystem access.
   • Isolate Gitea in a container or restricted environment to limit the impact of a path traversal or RCE.
   • Implement network segmentation to prevent a compromised Gitea instance from reaching critical internal services.
   • Regularly audit Git hooks and monitor for unauthorized modifications.
   • Use file integrity monitoring (FIM) for app.ini, the Git hooks directory, and other sensitive paths.

References

• NVD — CVE-2026-59774: https://nvd.nist.gov/vuln/detail/CVE-2026-59774
• MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• Gitea official security advisories (monitor for patch): https://github.com/go-gitea/gitea/security/advisories
• No known threat actor campaigns or exploit-in-the-wild evidence are documented at the time of writing. The vulnerability is not listed in CISA KEV.