目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-59774— Gitea Org-mode file disclosure and code execution

一分钟漏洞结论

影响对象
Gitea Gitea
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea serv

影响版本矩阵 1

厂商产品 版本范围状态
Gitea Gitea 1.22< 1.27.1 affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-59774 基础信息

漏洞信息

Shenlong is analyzing...

对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Gitea Org-mode file disclosure and code execution
来源: CVE Program / CVE List V5
Vulnerability Description
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
Gitea Gitea 1.22 ~ 1.27.1 -

二、漏洞 CVE-2026-59774 的公开POC

# POC 描述 源链接 神龙链接
1 Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an #+INCLUDE directive with an absolute path to the repository markup endpoint of any public repository, causing the server to read and render arbitrary files accessible to the Gitea service user. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-59774.yaml POC详情
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-59774 的情报信息

请登录查看更多情报信息。

CVE-2026-59774 补丁与修复 (2)

CVE-2026-59774 安全博客文章 (1)

CVE-2026-59774 其他参考 (2)

同批安全公告 · Gitea · 2026-10-14 · 共 36 条

CVE-2026-68964 Gitea restricted-user SSH and GPG key metadata disclosure
CVE-2026-70396 Gitea organization repository creation token scope bypass
CVE-2026-70406 Gitea private comparison disclosure with public-only tokens
CVE-2026-70400 Gitea private migration creation with public-only tokens
CVE-2026-70402 Gitea local code execution through writable Git hooks
CVE-2026-67577 Gitea restricted-user activity and heatmap disclosure
CVE-2026-63792 Gitea private reusable workflow disclosure to fork runs
CVE-2026-63021 Gitea Swift package manifest memory exhaustion
CVE-2026-62925 Gitea Alpine package parsing memory exhaustion
CVE-2026-70407 Gitea organization listing token scope bypass
CVE-2026-68957 Gitea restricted-user issue search disclosure
CVE-2026-73814 Gitea repository ownership escalation by administrators
CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target
CVE-2026-73535 Gitea second-factor bypass through OpenID identity linking
CVE-2026-73804 Gitea API token scope escalation through HTTP signatures
CVE-2026-73539 Gitea external renderer argument injection and code execution
CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification
CVE-2026-78433 Gitea private attachment disclosure through repository mismatch
CVE-2026-73130 Gitea repository initialization resource exhaustion
CVE-2026-73802 Gitea Runner host isolation bypass through container options

显示前 20 条，共 36 条。 查看全部 &rarr; →

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-22

V. Comments for CVE-2026-59774

暂无评论

发表评论