CVE-2026-59774: Gitea Unauthenticated Arbitrary File Read via Org-mode Include

Gitea is a self-hosted Git service. Its POST /{owner}/{repo}/markup endpoint renders markup on demand, and on any public repository with the code unit enabled it does so for anonymous visitors. Set the render mode to file and give the content a .org filename, and the Org-mode renderer runs. That renderer honours the #+INCLUDE directive, which accepts an absolute path, and Gitea left the go-org library's default file reader in place.

An attacker with no account and no write access submits Org-mode markup that includes any file the Gitea service user can read: app.ini, the internal token, OAuth and JWT secrets, database settings. With those secrets the published chain installs a Git hook and runs commands when an anonymous clone fires it. The advisory scores it 9.8. Gitea 1.27.1 fixes the issue.