Gitea versions 1.22.1 through 1.27.0 contain a critical remote file-read vulnerability tracked as CVE-2024-59774 (CVSS 9.8). Unauthenticated attackers can read any file accessible to the Gitea service account by exploiting malformed Org-mode markup in public repositories. No login or repository write permissions required.
The vulnerability stems from improper handling of Org-mode file processing. An attacker creates a public repository containing crafted Org-mode markup that triggers file-read functionality outside intended boundaries. When Gitea processes this markup, it exposes sensitive files on the underlying server, including configuration files, source code, and credentials.
This affects self-hosted Gitea instances widely deployed in enterprises as an alternative to GitHub. Organizations running affected versions face immediate risk of information disclosure. Attackers can extract database credentials, API keys, environment variables, and other sensitive data stored on the same server.
Gitea released version 1.27.1 to patch the flaw. All users running versions 1.22.1 through 1.27.0 should update immediately. The attack requires no sophistication. Proof-of-concept exploits will likely surface quickly if not already available. Public repositories mean any external user can attempt exploitation without authentication barriers.
Self-hosted Git platforms warrant particular attention because they often store critical development infrastructure and secrets. Unlike SaaS offerings with centralized security teams, self-hosted instances depend entirely on administrator vigilance for patching. Delayed updates create extended windows of exposure.
Organizations should prioritize this update across all Gitea deployments. Check audit logs for suspicious Org-mode file uploads or unusual file-access patterns in the past weeks. If running affected versions, assume potential compromise and rotate credentials associated with the Gitea service