AIKIDO-2026-541431
code.gitea.io/gitea is vulnerable to Path Traversal
98
Critical Risk
This Affects:
code.gitea.io/giteaTL;DR
The Org-mode markup renderer used by POST /{owner}/{repo}/markup initializes go-org with its default ReadFile callback, so a #+INCLUDE directive can read arbitrary absolute paths as the Gitea service user. An unauthenticated attacker can hit that route on a public repository, extract secrets such as INTERNAL_TOKEN from app.ini, and chain them into Git hook injection for remote code execution. The fix constrains Org-mode file inclusion so markup rendering cannot read arbitrary server paths.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and at least one repository is publicly readable with a code unit that the markup route accepts.
Background info
code.gitea.io/gitea is vulnerable to Path Traversal in versions 1.22.1 - 1.27.0.
How to fix this
Upgrade the gitea.dev and/or the code.gitea.io/gitea library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.