Description

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T15:17:20.677Z",
  "pubdate": "2026-10-14T15:17:20.677Z",
  "executiveSummary": "This vulnerability involves an Arbitrary File Read flaw within the Gitea Org-mode markup renderer. By exploiting improperly sanitized INCLUDE directives, an unauthenticated attacker can retrieve sensitive files accessible to the Gitea service account. The vulnerability exposes critical configuration files, including app.ini, which contain sensitive credentials such as the INTERNAL_TOKEN.\nThe impact of this vulnerability is critical, as it facilitates unauthorized access to internal system resources and potentially leads to Remote Code Execution (RCE). By leveraging the disclosed INTERNAL_TOKEN, an attacker can authenticate to internal endpoints, access loggers, and modify Git hooks. Successful exploitation allows for the execution of arbitrary commands under the privileges of the Gitea service account. This flaw poses a significant risk to the integrity and confidentiality of the entire Gitea instance and its underlying infrastructure. The vulnerability requires no authentication, making it reachable by any remote actor with access to the Gitea service. It highlights a failure in input validation and server-side resource isolation when processing specific markup file inclusions.",
  "technicalDetails": "The vulnerability originates in the Gitea Org-mode markup renderer component, which fails to adequately sanitize or restrict the path traversal capabilities of INCLUDE directives. Org-mode syntax allows for the inclusion of external files within documentation; however, the implementation does not enforce an allowlist or path restriction, enabling the rendering engine to access arbitrary files on the local filesystem.\nThe exploitation flow begins with an attacker creating or utilizing a public repository hosted on the target Gitea instance. The attacker introduces an Org-mode file containing a crafted INCLUDE directive, pointing to a sensitive file path, such as 'app.ini' or '/etc/passwd'. When the Gitea renderer processes this file—typically through the repository markup endpoint—the application backend reads the requested file from the disk and injects its contents into the rendered output displayed to the user.\nThe post-exploitation phase leverages the disclosure of the 'app.ini' configuration file. This file contains the 'INTERNAL_TOKEN', a secret key used for administrative communication between Gitea services. Armed with this token, an attacker can bypass standard authentication mechanisms to interact with internal APIs. Specifically, the attacker can target internal logger endpoints or administrative interfaces that lack sufficient authentication beyond the provided token. By manipulating these interfaces, an attacker can modify Git hooks—scripts that execute upon specific repository events. Because these hooks are executed by the Gitea service account, injecting malicious commands into these hooks results in arbitrary command execution on the host system. This essentially elevates an unauthenticated file read vulnerability to a full system compromise.\nThe attack is highly effective as it circumvents standard access controls via the renderer, which is designed to process user-supplied content. Since the rendering process occurs server-side, the Gitea service account's filesystem permissions are the only boundary, and the lack of a restricted 'chroot' or namespace isolation for the renderer allows the attacker to traverse the directory structure relative to the Gitea root or beyond."
}