hacker-news Aug 5, 2026 · Crawled Aug 5, 2026

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup

2 CVEs

AI Summary

A critical vulnerability in Gitea, tracked as CVE-2026-59774, allows unauthenticated attackers to read arbitrary files accessible by the Gitea service account by exploiting the Org-mode markup renderer. The flaw exists in versions 1.22.1 through 1.27.0 and is triggered via a crafted Org-mode #+INCLUDE directive processed by the /{owner}/{repo}/markup endpoint. Although not direct remote code execution, attackers can chain the file-read capability with reading app.ini to extract the INTERNAL_TOKEN and subsequently inject Git hooks to achieve command execution. The vulnerability was discovered by XBOW Security and independently reported by Shai Rod, with no known in-the-wild exploitation observed at the time of disclosure.

AI-extracted · verify before operational use

Extracted Entities 2 found

CVE CVE-2026-20896 → CVE CVE-2026-27771 →

MITRE ATT&CK TTPs 17 techniques

T1059 Command and Scripting Interpreter · Execution T1078.002 Domain Accounts · Defense Evasion T1087.003 Email Account · Discovery T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1555 Credentials from Password Stores · Credential Access T1027 Obfuscated Files or Information · Defense Evasion T1056.001 Keylogging · Collection T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1098 Account Manipulation · Persistence T1105 Ingress Tool Transfer · Command And Control T1114 Email Collection · Collection T1566 Phishing · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1588 Obtain Capabilities · Resource Development