Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
Gitea Org-mode file disclosure and code execution
Des templates Nuclei sont disponibles pour scanner cette vulnérabilité.
nuclei -t http/cves/2026/CVE-2026-59774.yaml -u target.com