Affected Systems
Gitea versions 1.22.1 through 1.27.0. Self-hosted instances with public repositories and Org-mode rendering enabled are vulnerable. Gitea Cloud instances upgraded automatically. Fixed in version 1.27.1.
Exploitation Status
No active exploitation reported as of August 5, 2026. Not listed on CISA KEV catalog. Vulnerability was publicly previewed before formal advisory. No independent public exploit demonstrating full RCE chain. Escalation path to RCE requires reading app.ini, extracting INTERNAL_TOKEN, and injecting Git hooks.
Business Impact
CVSS 9.8 Critical. Unauthenticated attackers can read arbitrary files accessible to the Gitea service account on instances with public repositories. Attack requires only crafted Org-mode markup submitted to public repository markup endpoint—no authentication or write access needed. Exposed files may include app.ini with internal tokens, database credentials, OAuth secrets, and JWT signing keys. Theoretical escalation to remote code execution exists via token extraction and Git hook injection, though no public exploit demonstrates this chain. Instances without public repositories are not exposed via this vector.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade all self-hosted Gitea instances to version 1.27.1 immediately. Verify Gitea Cloud instances completed automatic upgrade.
- Review web server logs for anonymous POST requests to /{owner}/{repo}/markup endpoint, especially requests with Mode: file or Org-mode content containing #+INCLUDE directives with absolute paths.
- If suspicious markup endpoint access is found on affected versions, rotate INTERNAL_TOKEN in app.ini, all OAuth credentials, JWT signing keys, and database passwords accessible to the Gitea service account.
- Inspect repository hook directories for unexpected executable files that may indicate attempted escalation to RCE via Git hook injection.
- If immediate patching is not possible, temporarily disable public repository access or restrict Org-mode rendering until upgrade is completed.