self-hosting Gitea? a stranger can read your server's secrets without logging in — patch today

A single +INCLUDE line in a Gitea markup preview is enough for an anonymous visitor to pull your server's config file straight off disk, and from… Aliteq Priya Nair · Software & Systems Editor

CVE-2026-59774 (CVSS 9.8) affects self-hosted Gitea 1.22.1 through 1.27.0.

An anonymous request to a public repo's markup preview can read any file the Gitea service account can access, including its own config.

That config file holds INTERNAL_TOKEN, which Gitea's own advisory documents as the key to injecting a Git hook and getting code execution.

Fixed in 1.27.1 — a straightforward version bump, no config changes required.

This isn't the only unauthenticated remote-code-execution path Gitea has had disclosed recently.

Anyone self-hosting Gitea 1.22.1 through 1.27.0 with even one public repository should upgrade to 1.27.1 today and rotate INTERNAL_TOKEN as a precaution. This is about as close to "no excuse to…

Read the full story

Aliteq self-hosting Gitea? a stranger can read your server's secrets without logging in — patch today Read the full story on Aliteq