Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-08-05 11:04 UTC
Importiert: 2026-08-11 09:48 UTC
Quelle-ID: thn_global
uid_hash: ea20a3e59d446051ded8bf928f2837a3f522ee8d44507b2463360f6d76d24eeb

The Hacker News

Inhalt

An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.

The file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-59774			CRITICAL	9.8			2026-10-14

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste