Risk Letters

Exploited vulnerability

CVE-2026-59774

TLP:CLEAR

Gitea Gitea Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger acces

Facts

  • Vendor: Gitea
  • Product: Gitea
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 28.3 %
  • First known exploitation: 15 October 2026
  • First seen by Risk Letters: 15 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD