Critical Gitea Arbitrary File Read Vulnerability Enables Remote Code Execution Attacks
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
A critical security flaw in Gitea, tracked as CVE-2026-59774, allows unauthenticated remote attackers to read arbitrary files from vulnerable servers and potentially escalate the attack to remote code execution. The issue affects Gitea versions from 1.22.1 through 1.27.0 and is fixed in version 1.27.1.
The vulnerability is documented as GHSA-6v53-hr58-556r and carries a Critical severity rating. It has a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation can occur remotely, requires no account, no user interaction, and can compromise confidentiality, integrity, and availability.
The flaw exists in Gitea’s repository markup-rendering feature. An attacker can send a crafted request to the POST /{owner}/{repo}/markup endpoint of a suitable public repository.
Because anonymous users can access this route when the repository is public and its code unit is enabled, the attacker does not need write access to the repository or an authenticated Gitea account.
Attackers can select file rendering mode and submit Org-mode content with an .org filename. The Org-mode renderer processes the #+INCLUDE directive, which can point to an absolute file path.
Gitea Arbitrary File Read Vulnerability
In affected releases, Gitea initializes the go-org library without replacing its default file-reading callback. The underlying library accepts the supplied path and reads it directly, using the operating system’s file access permissions.
As a result, an attacker may retrieve files readable by the Gitea service account. High-value targets can include the app.ini configuration file, deployment metadata, OAuth credentials, JWT-related secrets, database settings, and other locally accessible application material.
The GitHub advisory classifies the Gitea flaw as CWE-22 (path traversal), warning it could lead to remote code execution if attackers use the exposed INTERNAL_TOKEN to inject a Git hook.
The malicious hook may then run when an anonymous user clones a repository, executing attacker-controlled commands with the permissions of the Gitea operating-system user.
Gitea administrators should immediately upgrade all affected deployments to version 1.27.1 or a later patched release. Organizations should also review logs for unusual requests to repository markup endpoints, especially requests using Org-mode rendering, .org filenames, or suspicious include directives.
Security teams should rotate potentially exposed credentials after patching, particularly internal tokens, OAuth secrets, JWT keys, database passwords, and integration credentials stored in app.ini.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now .
#Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
Оригинальная версия на сайте:
Critical Gitea Arbitrary File Read Vulnerability Enables Remote Code Execution Attacks
Author: AbinayaA critical security flaw in Gitea, tracked as CVE-2026-59774, allows unauthenticated remote attackers to read arbitrary files from vulnerable servers and potentially escalate the attack to remote code execution. The issue affects Gitea versions from 1.22.1 through 1.27.0 and is fixed in version 1.27.1.
The vulnerability is documented as GHSA-6v53-hr58-556r and carries a Critical severity rating. It has a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that exploitation can occur remotely, requires no account, no user interaction, and can compromise confidentiality, integrity, and availability.
The flaw exists in Gitea’s repository markup-rendering feature. An attacker can send a crafted request to the POST /{owner}/{repo}/markup endpoint of a suitable public repository.
Because anonymous users can access this route when the repository is public and its code unit is enabled, the attacker does not need write access to the repository or an authenticated Gitea account.
Attackers can select file rendering mode and submit Org-mode content with an .org filename. The Org-mode renderer processes the #+INCLUDE directive, which can point to an absolute file path.
Gitea Arbitrary File Read Vulnerability
In affected releases, Gitea initializes the go-org library without replacing its default file-reading callback. The underlying library accepts the supplied path and reads it directly, using the operating system’s file access permissions.
As a result, an attacker may retrieve files readable by the Gitea service account. High-value targets can include the app.ini configuration file, deployment metadata, OAuth credentials, JWT-related secrets, database settings, and other locally accessible application material.
The GitHub advisory classifies the Gitea flaw as CWE-22 (path traversal), warning it could lead to remote code execution if attackers use the exposed INTERNAL_TOKEN to inject a Git hook.
The malicious hook may then run when an anonymous user clones a repository, executing attacker-controlled commands with the permissions of the Gitea operating-system user.
Gitea administrators should immediately upgrade all affected deployments to version 1.27.1 or a later patched release. Organizations should also review logs for unusual requests to repository markup endpoints, especially requests using Org-mode rendering, .org filenames, or suspicious include directives.
Security teams should rotate potentially exposed credentials after patching, particularly internal tokens, OAuth secrets, JWT keys, database passwords, and integration credentials stored in app.ini.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now .
#Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
Оригинальная версия на сайте:
