CVE-2026-73539— Gitea external renderer argument injection and code execution
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gitea 在将源自 Markup 上下文的 URL 代入外部渲染器命令模板时，未在处理前对引用路径进行转义，而是在进行 shell 样式的参数分割操作。构造的 Context 值可注入额外的渲染器参数，包括用于加载可执行过滤器的选项。对于使用易受影响的外部渲染器（如 pandoc）的部署实例，能够放置过滤器文件于可访问路径的攻击者，可致使该文件以 Gitea 服务账户的身份执行；而公开仓库的渲染接口本身无需认证即可访问。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73539
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea external renderer argument injection and code execution
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-73539
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73539
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-73539 (2)
Vendor Pages for CVE-2026-73539 (1)
-
🔗 Release v1.27.2 · go-gitea/gitea · GitHub release-notes
Other References for CVE-2026-73539 (1)
Other References for CVE-2026-73539 (1)
-
https://blog.gitea.com/release-of-1.27.2/ release-notes
Same Patch Batch · Gitea · 2026-10-14 · 36 CVEs total
| CVE-2026-62925 | Gitea Alpine package parsing memory exhaustion | |
| CVE-2026-70407 | Gitea organization listing token scope bypass | |
| CVE-2026-70396 | Gitea organization repository creation token scope bypass | |
| CVE-2026-70406 | Gitea private comparison disclosure with public-only tokens | |
| CVE-2026-70400 | Gitea private migration creation with public-only tokens | |
| CVE-2026-70402 | Gitea local code execution through writable Git hooks | |
| CVE-2026-67577 | Gitea restricted-user activity and heatmap disclosure | |
| CVE-2026-63792 | Gitea private reusable workflow disclosure to fork runs | |
| CVE-2026-63021 | Gitea Swift package manifest memory exhaustion | |
| CVE-2026-59774 | Gitea Org-mode file disclosure and code execution | |
| CVE-2026-68964 | Gitea restricted-user SSH and GPG key metadata disclosure | |
| CVE-2026-68957 | Gitea restricted-user issue search disclosure | |
| CVE-2026-73814 | Gitea repository ownership escalation by administrators | |
| CVE-2026-73800 | Gitea reusable workflow secret exposure in pull_request_target | |
| CVE-2026-73535 | Gitea second-factor bypass through OpenID identity linking | |
| CVE-2026-73804 | Gitea API token scope escalation through HTTP signatures | |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | |
| CVE-2026-78433 | Gitea private attachment disclosure through repository mismatch | |
| CVE-2026-73130 | Gitea repository initialization resource exhaustion | |
| CVE-2026-73802 | Gitea Runner host isolation bypass through container options |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73800
Gitea reusable workflow secret exposure in pull_request_targ
Same vendor: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73802
Gitea Runner host isolation bypass through container options
Same weakness: CWE-88
-
CVE-2026-104715
Cifs-utils: mount.cifs credential-file option injection allo -
CVE-2026-110859
GitPython before 3.2.0 Arbitrary File Read via Head.checkout -
CVE-2026-110858
GitPython 3.1.30 before 3.2.0 Command Injection via Remote.p -
CVE-2026-108390
HestiaCP Low-Privileged User to Root via Config-Field Inject -
CVE-2026-97798
Windows Error Reporting Service Elevation of Privilege Vulne
V. Comments for CVE-2026-73539
No comments yet