ID:12971 - Exploit for Path traversal in Gitea - CVE-2026-59774

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to path traversal in the Org-mode renderer when processing Org-mode markup containing a #+INCLUDE directive through the /{owner}/{repo}/markup endpoint. A remote attacker can submit a specially crafted markup request to execute arbitrary code.

Exploitation requires a publicly readable repository accepted by the markup route, and the issue can be chained by reading INTERNAL_TOKEN from app.ini and injecting a Git hook through the internal logger.

Remediation