A significant vulnerability in Gitea, identified as CVE-2026-59774, enables unauthenticated remote attackers to read arbitrary files on affected servers and potentially escalate to Remote Code Execution (RCE) This article explores vulnerability gitea identified. . The flaw was disclosed via GHSA-6v53-hr58-556r and affects versions 1.22.1 through 1.27.0, with a CVSS score of Critical: v3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vulnerability requires no authentication, user interaction, or elevated privileges, making internet-accessible Gitea instances highly concerning.
The critical vulnerability in Gitea Although the route involves repository assignment and reader checks, anonymous users can meet those requirements when accessing a public repository with readable code units enabled. Xbow Security revealed that an unauthenticated attacker can exploit a public repository's markup endpoint to retrieve files readable by the Gitea service account, including app.ini configuration and internal bearer tokens.
The issue is categorized under CWE-22, Improper Limitation of Pathname to Restricted Directory. Affected organizations are at risk if they run an affected Gitea release and host at least one publicly readable repository with code units accepted through the markup route. Standard Gitea storage permissions can also enable the service account to modify Gitea-managed global Git configurations, increasing the risk of Remote Code Execution (RCE).
Use ANY.RUN to cut SOC investigation blind spots and contain threats earlier, reducing response costs and business disruption.
