Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository m

Gitea's Org-mode markup

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account.

Do this now

Review files readable by the Gitea service account for secrets and rotate any exposed ones.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 20:17 UTC
Identifiers: CVE-2026-59774
CVSS: 9.8
Source: news
On the menu as: CI servers

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository m
Severity: critical. Patch status: fix status unknown.
Affected: Gitea's Org-mode markup
Ids: CVE-2026-59774

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account.

## Steps
1. This touches infrastructure (ci). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. There is no fix yet. Until one ships: Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-59774") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://blog.gitea.com/release-of-1.27.1/ https://nvd.nist.gov/vuln/detail/CVE-2026-59774
https://pwned.coffee/i/gitea-s-org-mode-markup-renderer-processes-include-direc-cve-2026-59774

Timeline

23 Oct 2026, 20:17 UTC
Proof-of-concept code for CVE-2026-59774 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee